Home / Technology / New "Unpatchable" Bug Hits iPhones, iPads, Watches
New "Unpatchable" Bug Hits iPhones, iPads, Watches
21 Jun
Summary
- A new hardware security flaw allows unauthorized code execution on some Apple devices.
- The usbliter8 vulnerability requires physical USB access to exploit during firmware updates.
- Affected devices include iPhone 11, Apple Watch Series 4, and older iPads.
A newly discovered hardware security vulnerability, named usbliter8, poses a significant risk to various Apple devices. This flaw allows for arbitrary code execution, meaning malicious actors could potentially run unauthorized commands on affected gadgets. The exploit specifically targets a vulnerability within Apple's SecureROM and a Synopsys DWC2 USB controller.
Successful exploitation requires the attacker to have physical access to the target device. They must connect a USB device during a firmware update to write data to unauthorized memory areas. This vulnerability has been identified in four Apple system-on-chips: A12, S4, S5, and A13.
Consequently, a range of popular devices are potentially impacted. This includes the iPhone XR, XS, 11 series, second-generation iPhone SE, Apple Watch Series 4 and 5, first-generation Apple Watch SE, and certain iPads such as the 8th generation model. Researchers emphasize that the vulnerability resides in immutable code, making hardware migration the most effective solution. While no exploitation has been reported in the wild, the discovery highlights potential lucrative rewards for ethical hackers.
