Paradigm Shift’s usbliter8 exploit targets Apple A12 and A13 SecureROM via USB DFU mode, creating an unpatchable hardware risk.

no comments (yet)

sorted by: hot top controversial new old
there doesn't seem to be anything here
17 comments in c/technology@lemmy.zip view that post
[–] 18 points 4 months ago

Seems like exactly the kind of exploit that could be used in a jailbreak process. Curious to see what else gets done with it

  • source
  • [–] 12 points 4 months ago (1 child)
  • [–] 9 points 4 months ago

    Hooray more jailbreaks!

  • source
  • [–] 3 points 4 months ago* (4 children)

    This requires physical access. I don't get it, why is this bad?

    Someone with physical access can already pull out the disk, clone it, and put in a different disk that boots to an identical looking login, but which actually relays the password back to the attacker.

    What more would this exploit allow an attcker with phsycal access that they wouldn't already have before this exploit?

  • source
  • hideshow 4 child comments
  • [–] 1 point 4 months ago* (last edited 4 months ago) (1 child)

    An attack via USB is much sneakier to pull off (no device surgery required) and more difficult to combat as an org. You essentially have to epoxy the ports shut or remove them physically and force your employees to charge their phones and tablets wirelessly. Not an unusual thing to do - I first saw this decades ago with PCs and laptops - but still.

    Fun fact: With laptops commonly using USB ports for charging these days, higher-end business-oriented ones tend retain the old barrel plug so that they can still be used with USB ports being rendered inoperable.

    Slightly off-topic: One of my last employers used software (I think it was a built-in utility of HP business computers) to disable USB ports on laptops instead, primarily to stop people from using insecure USB drives (only people working on really sensitive stuff had the ports epoxied). There was an internal file sharing service that was meant to be used in place of tiny drives you can accidentally lose, but it worked exceptionally poorly. They forgot that you can still transfer files via Bluetooth to virtually any other Bluetooth device that has storage, which is what I resorted to. It's slow, but reliable, works with anything (even old dumb phones) and is of course not as stupid as using a commercial cloud service, which is what some of my colleagues did.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 4 months ago

    Jailbreakme! Please.

  • source
  • [–] 0 points 4 months ago

    I think people already install Linux on those arm macbooks, no?

  • source
  • [+] -11 points 4 months ago (5 children)

    Holy shit you do know how to use the title field when creating a post! Good job

  • source
  • hideshow 5 child comments
  • [–] 4 points 4 months ago (4 children)

    What the hell are you talking about? I've checked OP's post history and everything has proper titles. Checked your comment history and the last post they made that you brought this up on likewise has an accurate title, and I'm not seeing any evidence that it was edited after posting.

    Most of all, why waste time complaining about it? Just block and move on with your life.

  • source
  • parent
  • hideshow 4 child comments
  • [+] -8 points 4 months ago (3 children)

    (content in post) is not a title. Funny how they changed their posts after I said something lol

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 4 months ago* (2 children)

    I've legitimately never seen this user post with that as the title, and I'm not seeing evidence they changed it.

    Take screenshots next time or block them, because you look like a nutter.

  • source
  • parent
  • hideshow 2 child comments
  • [–] -1 points 4 months ago* (1 child)
  • [–] 6 points 4 months ago

    Except all of those have titles outside Piefed buddy. Check the original instance directly, or from any Lemmy instance.

    It looks like this is an issue with Piefed not properly getting post titles from other instances, so maybe next time you can stop being an aggressive asshole.

  • source
  • parent
  • 3 comments in c/cybersecurity@sh.itjust.works view that post
    [–] 8 points 4 months ago (2 children)
  • [–] 9 points 4 months ago*

    Yes, but will only boot with an RP2350 plugged in.
    So, yes as long as the device doesn't reboot.
    Which reminds me of early iPhone Jailbreaks

    Post-exploitation, usbliter8 injects a custom USB request handler and stamps PWND:[usbliter8] into the device's USB serial string. From there, an attacker can temporarily demote the SoC's production mode or boot a raw, unsigned iBoot image with no signature checks, stepping outside Apple's chain of trust entirely.

  • source
  • parent