Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain

Security researchers at Paradigm Shift have released a new exploit named 'usbliter8' that allows for arbitrary code execution within the SecureROM of Apple's A12 and A13 chips. This SecureROM code is permanently embedded in the silicon during manufacturing, meaning the vulnerability cannot be fixed through software updates and will persist for the lifetime of the affected devices. The exploit is not a remote attack; it necessitates physical access to the device. The researchers demonstrated the exploit on an iPhone 8, which uses an A11 chip, but confirmed its applicability to A12 and A13 processors found in devices like the iPhone 11 series and iPhone XR/XS. The exploit targets a flaw in the USB deserialization process, enabling the execution of malicious code before the main operating system even boots. This allows for deeper system control than previously possible, potentially enabling persistent malware or unauthorized data access. Paradigm Shift has published a proof-of-concept video and technical details of the exploit, highlighting the significant security implications for millions of Apple devices. The company has not yet commented on the vulnerability.