Experts warn that malware can invade even when the iPhone is turned off



There is a paper that malware can be installed on the terminal even when the power is off by taking advantage of the function that can use '

find ' of the terminal even when the power is off, which is installed in iPhone with iOS 15 or later. It was announced.

[2205.06114] Evil Never Sleeps: When Wireless Malware Stays On After Turning Off iPhones
https://arxiv.org/abs/2205.06114

Malware Can Be Loaded Even Onto Phones That Are Turned Off, Researchers Show
https://www.vice.com/en/article/g5q4vj/malware-can-be-loaded-even-onto-phones-that-are-turned-off-researchers-show

With the update to iOS 15 , Apple has introduced a feature that allows the 'Find' network to be enabled for up to 24 hours even when the device with the 'Find' network turned on is turned off. It uses a U1 chip or Bluetooth chip that operates with low power consumption even when the power is turned off, and it is expected that even if the terminal is lost or stolen, it can be found more effectively. increase.



According to Jiska Classen of Technische Universität Darmstadt, Germany, theoretically, 'the Bluetooth chip can be hacked even when the terminal is turned off.'

However, since it is necessary to modify the OS (jailbreak) in advance to hack the Bluetooth chip, it is said that it is unlikely to cause damage to general users. Also, it has only been proved as a theory, and no one actually attacks or reports an attack using this method.

Classen disclosed the issues he found to Apple, but reported that he did not receive any feedback from the company.



Security researcher Ryan Duff said, 'Although the attacks described by Classen et al. Are useful as a way to inject malware, they have not been shown to be able to hack Bluetooth chips and then hack other parts of the device, so the device. Other techniques must be used at the same time for the overall hack. '' External connections are not valid when the power is off, so even if information is collected, it will be recovered by the attacker. Will be after the terminal is turned on. '

in Mobile,   Hardware,   Security, Posted by log1p_kr