Apple A12 and A13 devices harbor unpatchable BootROM flaw

Security researchers have disclosed a significant, unpatchable hardware vulnerability affecting millions of Apple devices, including iPhones, iPads, and Apple Watches powered by the company's A12 and A13 chips. The flaw, exploited through a proof-of-concept attack named "usbliter8," resides in the immutable BootROM code, meaning it cannot be fixed with any software update.

The vulnerability, detailed by the security firm Paradigm Shift, leverages a hardware bug in a specific USB controller combined with a firmware configuration flaw. It allows an attacker with physical access to a device to send specially crafted USB data while the device is in Device Firmware Update (DFU) mode during startup. This confuses the controller into writing data to incorrect areas of memory, granting control over the boot process before the iOS operating system loads. From there, an attacker can run unauthorized code, bypass signature checks, and boot modified system software.

Affected hardware includes devices using the Apple A12, A13, S4, and S5 system-on-chips. This encompasses the iPhone XS, XS Max, XR, and iPhone 11 series, several iPad models, and Apple Watch Series 4 and 5. The researchers...