Apple iPhone: Security flaw in USB-C port could let malware access sensitive data

The USB-C port on the Apple iPhone 15 and 16 is handled by a controller chip developed by Apple. According to Cyber Security News, security researchers have managed to hack this proprietary chip, named ACE3. Due to security enhancements, the hacking process is reportedly much more challenging than on the previous ACE2 controller, found in devices such as MacBooks.

By analysing electromagnetic signals during the bootup process, the researchers were able to determine the exact moment when the firmware is validated. Using a technique called “electromagnetic fault injection”, modified firmware can be loaded onto an iPhone and booted by the controller after bypassing Apple’s validation. The experts said this carries serious implications for the security of iPhones because a piece of modified firmware could perform a jailbreak or even make changes to iOS, theoretically allowing malware to gain access to sensitive data or hijack individual functions on an iPhone.

However, malicious individuals must have physical access to an iPhone in order to carry out such an attack, meaning this security flaw shouldn’t become a problem for most users. In the meantime, BleepingComputer has reported on new phishing attacks aimed at bypassing one of iMessage’s security features. Even though Apple automatically disables links in messages from those not in contacts, the links will be enabled as soon as the recipient replies. Threat actors are exploiting this behaviour by tricking their targets into responding to messages. For instance, attackers might try to convince potential victims that they can prevent further messages by sending the word “STOP”. Once a reply is received, would-be criminals are free to send phishing links via iMessage. As with e-mails, it is not advisable to open any links from sources you don’t trust.