EN PT-BR
← Voltar ao feed
medium cryptocurrency consumer

Unpatchable BootROM flaws checkm8 and usbliter8 put crypto recovery phrases on old iPhones at risk

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 09:01 · coletado há 1 hora

Older iPhones used to store cryptocurrency recovery phrases remain exposed to unpatchable BootROM vulnerabilities, even after a factory reset or when kept in airplane mode. OneKey founder Yishi Wang warned against treating retired iPhones as cold wallets. Exploitation requires physical access, and boot-level code execution does not by itself decrypt wallet data, but it can be combined with other weaknesses to steal a seed phrase.

Detalhes técnicos

  • checkm8 (disclosed 2019) affects iPhone 4S through iPhone X.
  • usbliter8 extends boot-chain compromise to A12 and A13 devices (iPhone XS, XR, iPhone 11 family, iPhone SE 2nd gen).
  • The attacker places the device in DFU mode and connects specialized USB hardware, such as an RP2350-based microcontroller. Malformed USB setup packets trigger a DMA pointer underflow that writes into SecureROM memory. The Data Address Resolution Table configuration fails to contain those writes. A13 exploitation also requires bypassing Pointer Authentication.
  • The Secure Enclave is not directly compromised. Risk rises with outdated iOS, weak passcodes and weak wallet passwords, because a wallet file protected only by a weak password can be guessed offline.
  • ChoiceJacking via malicious charging ports is a separate threat and is distinct from BootROM exploitation.

Remediação

  • Migrate exposed wallets to a newly generated recovery phrase created in a trusted environment, then transfer the assets. Adding another address under the same seed does not invalidate a stolen phrase.
  • Keep physical custody of devices, use strong alphanumeric passcodes, keep software current and use trusted charging equipment.
  • Newer hardware reduces exposure to these specific exploits.

Linha do tempo

  1. gbhackers.com ↗ · pub. 02/11/2026 09:01 · coletado 02/11 10:00 primeiro registro

    Unpatchable BootROM flaws checkm8 and usbliter8 put crypto recovery phrases on old iPhones at risk

    ler a análise desta fonte

    Older iPhones used to store cryptocurrency recovery phrases remain exposed to unpatchable BootROM vulnerabilities, even after a factory reset or when kept in airplane mode. OneKey founder Yishi Wang warned against treating retired iPhones as cold wallets. Exploitation requires physical access, and boot-level code execution does not by itself decrypt wallet data, but it can be combined with other weaknesses to steal a seed phrase.

    Technical Details

    • checkm8 (disclosed 2019) affects iPhone 4S through iPhone X.
    • usbliter8 extends boot-chain compromise to A12 and A13 devices (iPhone XS, XR, iPhone 11 family, iPhone SE 2nd gen).
    • The attacker places the device in DFU mode and connects specialized USB hardware, such as an RP2350-based microcontroller. Malformed USB setup packets trigger a DMA pointer underflow that writes into SecureROM memory. The Data Address Resolution Table configuration fails to contain those writes. A13 exploitation also requires bypassing Pointer Authentication.
    • The Secure Enclave is not directly compromised. Risk rises with outdated iOS, weak passcodes and weak wallet passwords, because a wallet file protected only by a weak password can be guessed offline.
    • ChoiceJacking via malicious charging ports is a separate threat and is distinct from BootROM exploitation.

    Remediation

    • Migrate exposed wallets to a newly generated recovery phrase created in a trusted environment, then transfer the assets. Adding another address under the same seed does not invalidate a stolen phrase.
    • Keep physical custody of devices, use strong alphanumeric passcodes, keep software current and use trusted charging equipment.
    • Newer hardware reduces exposure to these specific exploits.