gfi4WJfulaĪpple didn't bother to explain how exactly that works, but researchers found it is achieved by keeping the Bluetooth LPM chip active and running autonomously even when the iPhone is switched off. In iOS 15, the phone is findable even when “Powered off”. Never trust that a device is fully turned offĪpple introduced a new feature in iOS 15, making it possible for users to locate their iPhones through 'Find My' even if they are powered off. Upon launching the SpringBoard, the backboardd lets SpringBoard take over the screen. The user will see the Apple Logo effect upon restarting. Hence malicious code won't have any problem continuing to run after this kind of reboot. This will exit all processes and restart the system without touching the kernel.

What it does is to leverage local SSH access to gain root privilege, then we execute /bin/launchctl reboot userspace. The file will unleash the SpringBoard and trigger a special code block in our injected dylib. ZecOps describes the next step in the 'NoReboot' attack as follows: 'BackBoardd' is another iOS daemon that logs physical button click and screen touch events with timestamps, so abusing it gives the trojan the power to know when the user attempts to 'turn on' the phone.īy monitoring these actions, the user can be deceived to release the button earlier than they were supposed to, avoiding an actual forced restart. Next, the 'BackBoardd' daemon is commanded to display the spinning wheel that indicates the shutdown process is underway. Security researchers from ZecOps have developed a trojan PoC (proof of concept) tool that can inject specially crafted code onto three iOS daemons to fake a shut down by disabling all the above indicators. When an iPhone is shut off, its screen naturally goes dark, the camera is turned off, 3D touch feedback does not respond to long presses, sounds from calls and notifications are muted, and all vibrations are absent. To restart the iPhone, one has to press and hold the power button and either volume button until the slider with the reboot option appears, and then wait for roughly 30 seconds for the action to complete. However, this technique hooks the shutdown and reboot routines to prevent them from ever happening, allowing malware to achieve persistence as the device is never actually turned off.īecause this attack, which the researchers call 'NoReboot,' does not exploit any flaws on the iOS and instead relies on human-level deception, it cannot be patched by Apple. Historically, when malware infects an iOS device, it can be removed simply by restarting the device, which clears the malware from memory. Researchers have developed a new technique that fakes a shutdown or reboot of iPhones, preventing malware from being removed and allowing hackers to secretly snoop on microphones and receive sensitive data via a live network connection.

Fake apple virus scan