Security researchers have published a new unpatchable SecureROM exploit for Apple's A12 and A13 chips, extending public BootROM exploitation beyond the devices affected by checkm8. iPhone XR Security firm Paradigm Shift disclosed the unpatched exploit, called usbliter8, on June 18. It achieves code execution through a flaw in Apple's USB boot process. The vulnerability affects devices powered by Apple's A12 and A13 chips, including the iPhone XS, iPhone XS Max, iPhone XR, and iPhone 11 lineup. Several iPad models and Apple Watch devices powered by S4 and S5 chips are affected as well. Continue Reading on AppleInsider | Discuss on our Forums
Apple is bringing alternative app marketplaces and payment options to iPhone users in Brazil under an agreement with the country's antitrust regulator, extending App Store changes that were previously limited to the European Union. Apple announces changes to iOS in Brazil The changes reflect an agreement with Brazil's competition regulator, the Conselho Administrativo de Defesa Economica, known as CADE, and will arrive as part of iOS 26.5. Developers can begin integrating the new capabilities immediately. Developers in Brazil will be able to distribute iPhone apps through marketplaces outside the App Store. Marketplace operators must receive authorization from Apple and comply with ongoing requirements. Apple will also require apps distributed through alternative marketplaces to pass a notarization process. The company said the review combines automated checks and human oversight designed to identify malware and other known security threats. Continue Reading on AppleInsider | Discuss on our Forums
Apple TV will stream an entire Formula 1 race weekend free to U.S. viewers for the first time, opening every Austrian Grand Prix session to fans without a subscription. Austrian Grand Prix Viewers in the United States will be able to watch all Formula 1 Austrian Grand Prix sessions live through Apple TV at no cost. The free access runs from June 26 through June 28 and includes every on-track session, from practice and qualifying to Sunday's Grand Prix. The schedule begins with Practice 1 at 7:30 a.m. Eastern on June 26, followed by Practice 2 at 11 a.m. Practice 3 starts at 6:30 a.m. on June 27, with qualifying at 10 a.m. The Austrian Grand Prix is scheduled to begin at 9 a.m. Eastern on June 28. Apple said the Austrian Grand Prix marks the first time it has made an entire Formula 1 race weekend available free to viewers in the United States. The company has offered free sports programming before, but this promotion includes every Formula 1 session across a race weekend rather than a single event. Continue Reading on AppleInsider | Discuss on our Forums
Security research firm Paradigm Shift today published details of a new BootROM vulnerability affecting Apple's A12 and A13 chips, along with a working proof-of-concept exploit named "usbliter8." The BootROM, or SecureROM, is the first code an iPhone runs when it powers on. Because it is baked directly into the chip at manufacture, any vulnerability found there cannot be fixed with a software update, meaning affected devices will remain vulnerable for the rest of their lives. The last publicly known BootROM exploit of this kind was "checkm8," released in 2019 which affected devices from the iPhone 4S through to the iPhone X. usbliter8 now extends that history to the next generation of chips, covering the iPhone XS through to the iPhone 11 series. The exploit works by taking advantage of a bug in the USB controller built into Apple's chips. When an iPhone receives USB data during startup, the controller uses a memory buffer to store incoming packets. Paradigm Shift found that by sending a specific sequence of unusually small packets, they could manipulate an internal hardware pointer in a way that causes it to walk backwards through memory, allowing data to be written to locations it should never reach. The researchers say this appears to be a bug in the USB controller hardware itself, not in Apple's software. The A11 chip, used in the iPhone X, is not affected because its USB driver manually resets the pointer after each packet. A14 and later chips are also safe, as they configure a memory protection feature correctly at the BootROM level. The A12 and A13 sit in a vulnerable middle ground between the two. On A12 devices, gaining code execution is relatively straightforward. On A13 devices, things are considerably harder because Apple introduced a security feature called Pointer Authentication Codes (PAC), which detects and blocks certain types of memory tampering. Paradigm Shift says working around PAC on the A13 required a lengthy multi-step process before the researchers could finally take control of the processor. Once in control, the exploit installs a custom handler that survives a device restart and adds two capabilities: temporarily lowering the device's security settings, and booting unsigned software without any verification checks. It also injects the traditional "PWND" string into the iPhone's USB serial number as a signal that the device has been compromised, a convention that carries over from checkm8 and earlier exploits . Paradigm Shift notes that while usbliter8 does not affect the Secure Enclave directly, a BootROM compromise of this kind opens up wider avenues for attacking it. The firm says it reported its findings to Apple Product Security before publication and worked with Apple on coordinated disclosure. The full proof-of-concept code has been published alongside the write-up at ps.tc . Tag: Apple Security Related Forum: iPhone This article, " Apple's A12 and A13 Chips Facing New Unpatchable Exploit " first appeared on MacRumors.com Discuss this article in our forums
