Wikinews interviews Secure Mobile Networking Lab about iPhone vulnerability in low power mode
 |
This article is a prepared story. It describes an event that is scheduled or expected but has not yet occurred. |
| This article is a prepared story. It describes an event that is scheduled or expected but has not yet occurred. If this article is ready to be developed, change the {{prepare}} tag to {{develop}}. Prepared articles may (tempered by common sense, please) be subject to deletion if unsourced (with 10 days' notice) or if unused and expired (after 5 days). |
 |
This article is being developed. You can contribute or discuss its development. |
| This article is being developed. You can contribute or discuss its development. If it is ready to be checked, you can Submit for review. This is not a way to ask others to expand or finish the article! You should review discussion about this article, and verify original reporting notes are adequate. Click to add OR notes. |
Thursday, June 2, 2022
You can add an infobox from Category:Infoboxes.
On 12 May 2022, Secure Mobile Networking Lab, TU Darmstadt, Germany published a report of vulnerability in a jailbroken iPhone that allows an attacker to gain control over the device when it is seemingly off. In what is known as low-power mode, some chips of the device continue to run, with the benign intent of supplying users with some limited functionality, such as finding their device and some types of contactless keys.
The low-power mode involves supplying power to the Bluetooth chip, and the researchers showed how this could be misused to add malware to the device. This malware would operate in the low-power mode without switching on the device. The reporters noted jailbroken devices were not common, and majority of consumers did not jailbreak their phones. Furthermore, the researchers pointed out that this attack vector needed more research to evaluate the risk of writing more sophisticated malware that can attack non-jailbroken devices.
Researchers published their modified Broadcom firmware at InternalBlue and Frankenstein repositories.
Interview questions[edit]
((WN
)) When did you start looking at the low power mode? What prompted your interest?
((WN)) Is low-power mode common in devices? Which ones have it and which ones don't?
((WN)) Were low-power mode attacks, or discoveries of vulnerability, common previously? Could you please share some examples?
((WN)) Is it possible to disable low-power mode in an iPhone completely? If so, how can this be achieved?
((WN)) What iPhone/iOS versions are affected?
((WN)) Do you see any privacy concerns with the device never becoming truly off? Is it possible for the users to "truly power off" the phone via a special combination of keys, or by adjusting their settings?
((WN)) What is your opinion about battery not being removable on some modern smart phones? Do you think this makes them more vulnerable?
((WN)) Has Apple released a fix? For example, does upgrading iPhone software help to resolve this problem?
((WN)) Do you find Apple products contribution to the market improves users' privacy and smartphones' security, or the opposite? What major breakthroughs have major phone or cellular provider companies have contributed towards privacy and security of non-face-to-face communication in your experience? What companies, as an example that you know of, set a good example in this area?
((WN)) Do you see problems with how Apple or another smartphone device or smartphone OS manufacturer tries to control the users? With surveillance from them, or perhaps from cellular networks operators? If so, who are the better players in this area that in your view should set an example to others?
((WN)) Are you also working on analyzing the vulnerability of other devices - iPads or non-Apple devices? Perhaps smartwatches? Do you think their low power mode may pose a similar risk?
((WN)) Do you see this attack venue being utilized to control a car that has contactless keys, or is this uncommon because the device is not jailbroken?
Sources[edit]
 |
Note:First two sources written by the same author, based on the third source. It would be great to have at least one more independent source. |
- Dan Goodin. "Researchers devise iPhone malware that runs even when device is turned off" — ars technica, May 17, 2022
- Dan Goodin. "Your iPhone Is Vulnerable to a Malware Attack Even When It’s Off" — WIRED, May 17, 2022
- "Evil Never Sleeps: When Wireless Malware Stays On After Turning Off iPhones" — Secure Mobile Networking Lab, TU Darmstadt, May 12, 2022