Apple A12 A13 USB Flaw Cannot Be Patched

When it comes to cybersecurity, there's one rule that never changes: no device is completely secure. 🔐
Even Apple, known for its strong security and privacy features, is not immune to hardware vulnerabilities.

Security researchers from Paradigm Shift recently revealed a new exploit called usbliter8 that affects Apple's A12 and A13 processors. The most concerning part? Apple cannot fix it with an iOS update because the flaw exists inside the processor hardware itself.

---

What Is the usbliter8 Vulnerability?​

The newly discovered usbliter8 vulnerability targets a critical component known as the BootROM (also called SecureROM).
BootROM is the very first code executed when an iPhone powers on. It initializes the device before iOS even starts loading.

Unlike software, BootROM is permanently embedded into the processor during manufacturing. Once a device leaves the factory, the code cannot be modified.

That means if a vulnerability is found inside BootROM, no firmware update or iOS security patch can completely remove it. 🚨
As a result, affected devices may remain vulnerable for their entire lifespan.

---

How the Attack Works​

Researchers discovered a flaw in the USB controller integrated directly into Apple's A12 and A13 chips.
During the boot process, the USB controller receives and stores incoming USB packets in memory.
Under normal conditions, an internal memory pointer moves forward as data arrives.
However, researchers found that sending a carefully crafted sequence of very small USB packets causes the pointer to move backward instead of forward.
This unexpected behavior allows an attacker to overwrite memory locations that should normally be inaccessible.
The result is the ability to execute unauthorized code at one of the most privileged levels of the device. ⚠️

---

Why This Vulnerability Is So Serious​

Unlike traditional software vulnerabilities, this issue exists in the processor hardware itself.
Because the flaw is embedded in the chip design, Apple cannot simply release a security update to fix it.
Researchers believe affected devices will remain vulnerable forever unless the hardware is replaced.
This makes usbliter8 one of the most significant Apple hardware security vulnerabilities discovered in recent years.

---

Why A11 and A14 Chips Are Not Affected​

Interestingly, not all Apple processors are vulnerable.

A11 Processors​

Devices powered by the A11 chip, including iPhone X, are not affected.
The reason is that the USB driver in A11 resets the memory pointer after each incoming packet, preventing the exploit from working.

A14 and Newer Processors​

Apple improved security in A14 chips and later generations by introducing additional memory protection mechanisms directly within BootROM.
These protections block the attack before it can gain control of the system.

As a result, A12 and A13 processors ended up in an unfortunate middle ground:

❌ Missing the A11 mitigation​

❌ Missing the advanced A14 protections​

---

A13 Security Was Harder to Bypass​

Researchers noted that exploiting A13-based devices was significantly more difficult.
The reason is Apple's security technology known as Pointer Authentication Codes (PAC).
PAC helps protect memory by detecting attempts to manipulate critical pointers and memory addresses.

To achieve full control of the processor, researchers had to perform a long and complex chain of exploitation steps to bypass these protections. 🔬

This demonstrates how effective modern hardware security mechanisms can be, even when vulnerabilities exist elsewhere in the system.

---

What Happens After a Successful Exploit?​

Once the exploit succeeds, a custom component can be installed that remains active even after the device is rebooted.
This allows attackers to gain additional capabilities such as:

✅ Lowering security protections temporarily​

✅ Running unsigned applications​

✅ Bypassing certain verification mechanisms​

✅ Modifying low-level device behavior​

Like many jailbreak-related exploits, the attack also injects the word PWND into the USB serial identifier as an indication that the device has been successfully compromised. 😎

---

Does the Vulnerability Affect Secure Enclave?​

The good news is that researchers confirmed the vulnerability does not directly compromise the Secure Enclave.
Secure Enclave is Apple's dedicated security processor responsible for protecting:

• Face ID data
• Touch ID fingerprints
• Encryption keys
• Sensitive user information

However, researchers warn that gaining control of BootROM creates new attack opportunities that could potentially be used in future research targeting other protected components.

---

Apple Was Informed Before Public Disclosure​

According to the research team, Apple was notified about the vulnerability before technical details were released.
The disclosure followed responsible security reporting procedures, allowing Apple's product security team to review the findings before publication.
While Apple cannot fully patch the hardware flaw, the company was given advance notice to assess potential risks and mitigation strategies.

---

List of Affected Apple Devices​

The following Apple devices are directly affected by the usbliter8 vulnerability:

iPhones​

📱 iPhone XS
📱 iPhone XS Max
📱 iPhone XR
📱 iPhone 11
📱 iPhone 11 Pro
📱 iPhone 11 Pro Max
📱 iPhone SE (2nd Generation)

iPads​

📱 Multiple iPad models powered by Apple A12 and A13 processors

---

Final Thoughts​

The discovery of usbliter8 highlights an important reality in cybersecurity: even the most secure hardware can contain hidden vulnerabilities.
While exploiting this flaw requires physical USB access and advanced technical knowledge, its existence demonstrates the long-term risks associated with hardware-level security bugs.
As Apple continues improving processor security with newer chip generations, vulnerabilities like usbliter8 serve as a reminder that security is an ongoing process rather than a final destination. 🔐🚀