▲ 35 ▼ Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain (thehackernews.com) submitted 4 months ago by kid@sh.itjust.works to c/cybersecurity@sh.itjust.works 3 comments fedilink hide all child comments
[–] hayvan@piefed.world 8 points 4 months ago (2 children) so, custom ROM possible? permalink fedilink source hideshow 2 child comments replies: [–] towerful@programming.dev 9 points 4 months ago* Yes, but will only boot with an RP2350 plugged in. So, yes as long as the device doesn't reboot. Which reminds me of early iPhone Jailbreaks Post-exploitation, usbliter8 injects a custom USB request handler and stamps PWND:[usbliter8] into the device's USB serial string. From there, an attacker can temporarily demote the SoC's production mode or boot a raw, unsigned iBoot image with no signature checks, stepping outside Apple's chain of trust entirely. permalink fedilink source parent [–] SayJess@lemmy.blahaj.zone 1 point 4 months ago Highly unlikely permalink fedilink source parent
[–] towerful@programming.dev 9 points 4 months ago* Yes, but will only boot with an RP2350 plugged in. So, yes as long as the device doesn't reboot. Which reminds me of early iPhone Jailbreaks Post-exploitation, usbliter8 injects a custom USB request handler and stamps PWND:[usbliter8] into the device's USB serial string. From there, an attacker can temporarily demote the SoC's production mode or boot a raw, unsigned iBoot image with no signature checks, stepping outside Apple's chain of trust entirely. permalink fedilink source parent