TLDR Tech / InfoSec
Apple's A12 and A13 Chips Facing New Unpatchable Exploit
Paradigm Shift published "usbliter8," a BootROM exploit against Apple's A12 and A13 chips that abuses a USB controller bug: sending a sequence of unusually small packets during startup walks an internal hardware pointer backward through memory, enabling out-of-bounds writes, and because the flaw sits in mask ROM, it cannot be patched, leaving iPhone XS through iPhone 11 vulnerable for life. A11 escapes because its USB driver resets the pointer per packet, and A14 and Later configure memory protection correctly at boot, whereas A13 exploitation required a lengthy, multi-step bypass of Pointer Authentication Codes (PAC). Once executed, the exploit installs a restart-surviving handler that can downgrade security settings and boot unsigned code, injects the "PWND" string into the USB serial, and, while it spares the Secure Enclave directly, it broadens avenues for attacking it.
Read the full story