Update, Jan. 13, 2025: This story, originally published Jan. 12, now includes analysis of the iPhone USB-C hack from security experts, including the inventor of the O.MG Cable USB hacking tool.
With 100 million macOS users already reeling from news of a new credential-stealing attack, Safari users warned do not click twice, and even a report about iOS being targeted more by hackers than Android, it’s not been the most reassuring few weeks for Apple users. Now security researchers have disclosed details of a successful bypass of Apple security protections to hack the iPhone USB-C controller. So, what does this mean for smartphone security?
Hacking The iPhone USB-C Controller
The video of a talk bya security researcher, presented at the 38th Chaos Communication Congress, also known as 38C3, at the end of 2024 in Hamburg, Germany, has just been made available. The four-day conference that covers “technology, society and utopia” is organized by the legendary Chaos Computer Club and can usually be guaranteed to result in something shocking for the security community. 38C3 was no exception, and, at least as far as I’m concerned, that shocker was the hacking of Apple’s highly customized ACE3 USB-C controller that first appeared in the iPhone 15 series. Thomas Roth, also known by the hacker handle of stacksmashing, describes themselves as a security researcher who “creates videos on reverse-engineering, hardware security, and everything else I find interesting.” And thank goodness they do. If you are of a technical mindset then please go and check out the full 38C3 presentation video. For everyone else, here’s the TL;DR.
The ACE3 custom USB-C controller was introduced with the iPhone 15 and iPhone 15 Pro series, which brought the change to USB-C for Apple’s smartphone users. Roth explained how, as well as managing USB power delivery for the iPhone, the device is a “full microcontroller running a full USB stack connected to some of the internal busses of the device.” The researcher was able to exploit a multitude of different things, including reverse engineering, side-channel analysis and electromagnetic fault-injection in order to achieve code execution on the ACE3. What does that all mean? Roth could dump the ROM and analyze functionality as a result.
I have approached Apple for a statement.
Stacksmashing Explains The iPhone USB-C Hack Vulnerability Risk
I spoke to Roth to find out more. First the good news: when it comes to the broader smartphone ecosystem, Android users take note, Roth told me that the research “does not have much impact beyond the iPhone/MacBook,” so you can relax. But what about iOS users? I asked Roth about the potential impacts that his USB-C hack could have on iPhone security. “When we look at the security of modern smartphones,” Roth explained, “there are many aspects that can be insecure: software running on the main processor, but also software running in the baseband (which handles the mobile connectivity), the secure element, or chips such as the ACE3.” Roth went on to say that the most significant difficulty is how anyone can begin to research a chip in a device for which there is no available documentation or firmware. “By showing how one can get code-execution (and dump the firmware) of the ACE3, it essentially lays the groundwork for further research,” Roth said, “and by having the firmware, one can now start looking for software vulnerabilities that might be there.” Things could, therefore, start to get interesting from this point on if any new security vulnerabilities are uncovered. Really interesting, to be honest, depending on who finds them: not everyone exploring such hackery has good intentions like Roth, after all.
Talking of which, I asked about the contact that Roth had with Apple regarding his research findings. Roth told me that he had reported both his earlier ACE2 attack and the ACE3 attack to Apple. “For the ACE2 (software) attack they at first confirmed that they’d fix it in fall 2024, but then notified me that they won’t fix it as it’s a hardware issue,” Roth said. When it came to the ACE3 attack, however, Roth said that while Apple “saw the attack complexity and said that they don’t see it as a threat – I agree with that sentiment but wanted to at least have reported it!” The reasoning being, Roth told me, that as already explained “this is essentially foundational research, the first steps that are needed to find other attacks on the chip.”
Interestingly, Roth also said that he has been contacted by a number of third-party Apple repair specialists who have said that they have already found the research “helpful to diagnose and repair broken Macs.”
Security Experts Speak Out About The iPhone USB-C Hack
I spoke to Mike Grover, best known as MG, the inventor of the O.MG Cable computer in a USB cable hacking tool, who said that he thought the research was very cool. “I’m looking forward to the research that will come from the dumped firmware,” Grover said, adding that he thought “the risk assessment is correct.” While reasonably sure that Apple will “eventually make a hardware revision,” Grover warned that “the perceived complexity of the attack is something that can be significantly reduced with a bit of effort,” which should be heeded by those thinking this is something of a nothing-burger.
Rich Newton, managing consultant at Pentest People, said that the “Apple iPhone USB-C hack revelation highlights the importance of robust safeguards against juice jacking, which exploits public charging ports to compromise devices,” and recommended users employ technical controls such as “USB data blockers or charge-only cables ensure power transfer without data exchange.”
Meanwhile, Adam Pilton, a senior cybersecurity consultant at Cybersmart, said that while it is, of course, important to be clear that currently there is no immediate risk to Apple users, “the fact that cybercriminals could potentially dump the ROM and analyze its functionality is a concern.” Also of concern to Pilton, however, is Apple’s response: “Essentially, they’re aware, but it’s a hardware issue, so they’re not going to do anything,” he said. Yet having access to read-only memory, for a cybercriminal, is “like holding the blueprint for a bank,” Pilton warned, “Cyber criminals will meticulously review this information to find a weakness or a back door that will allow them to gain access and commit their criminality.” Acting now, instead of later, could save iPhone users a lot of potential pain further down the line, Pilton said, concluding, “Time will tell if vulnerabilities are discovered, but I’m confident to say that nation states will show particular interest in this news and will find a way to use this information against the interests of Apple and their customers.”
