People who wipe an old iPhone, turn on Airplane Mode, and use it solely to store their recovery phrase may find the risk hiding in the chip inside the phone—a system update can’t fix it.
OneKey founder @ohyishi posted a warning last night. The post has had about 51,000 views. The BootROM in iPhone 4S through iPhone X models has the checkm8 vulnerability, which was disclosed in 2019. usbliter8, disclosed this June, also affects the iPhone XS, XR, 11 series, and second-generation SE. BootROM is startup code burned into the chip at the factory. Apple can’t patch it with an iOS update, so these devices will always have this vulnerability.
This kind of attack doesn’t require an internet connection, either. Once someone gets hold of the phone, they can put it into DFU mode, connect a specially made USB board, and run their own code before iOS starts up. The board used in the published research was a $5 Raspberry Pi Pico 2. So Airplane Mode won’t help here.
He also clarified that on models like the XS and 11, this vulnerability alone isn’t enough to obtain the recovery phrase; the lock screen passcode and Secure Enclave still stand in the way. But these are exactly the two layers people are most likely to skimp on: a 6-digit passcode has just 1 million possible combinations, and if a wallet app encrypts the recovery phrase with only a short password, an attacker who copies the encrypted file can take it home and guess offline, with no limit on attempts.
So his advice to iPhone 11 and older users is to replace the whole setup: generate a completely new recovery phrase in a trusted environment, then transfer your assets to it. Creating new addresses under the old recovery phrase won’t help. According to him, no BootROM vulnerabilities have been publicly disclosed for iPhone 12 and later models so far.
$BTC
OneKey founder @ohyishi posted a warning last night. The post has had about 51,000 views. The BootROM in iPhone 4S through iPhone X models has the checkm8 vulnerability, which was disclosed in 2019. usbliter8, disclosed this June, also affects the iPhone XS, XR, 11 series, and second-generation SE. BootROM is startup code burned into the chip at the factory. Apple can’t patch it with an iOS update, so these devices will always have this vulnerability.
This kind of attack doesn’t require an internet connection, either. Once someone gets hold of the phone, they can put it into DFU mode, connect a specially made USB board, and run their own code before iOS starts up. The board used in the published research was a $5 Raspberry Pi Pico 2. So Airplane Mode won’t help here.
He also clarified that on models like the XS and 11, this vulnerability alone isn’t enough to obtain the recovery phrase; the lock screen passcode and Secure Enclave still stand in the way. But these are exactly the two layers people are most likely to skimp on: a 6-digit passcode has just 1 million possible combinations, and if a wallet app encrypts the recovery phrase with only a short password, an attacker who copies the encrypted file can take it home and guess offline, with no limit on attempts.
So his advice to iPhone 11 and older users is to replace the whole setup: generate a completely new recovery phrase in a trusted environment, then transfer your assets to it. Creating new addresses under the old recovery phrase won’t help. According to him, no BootROM vulnerabilities have been publicly disclosed for iPhone 12 and later models so far.
$BTC
