Older iPhones BootROM flaws risk crypto seed phrases, GBHackers reports
GBHackers reports unpatchable BootROM flaws in older iPhones could expose stored crypto seeds; move funds to a new seed made on trusted hardware.
- Published
- Exploitation
- No, not confirmed: the source describes physical-access exploit techniques and reports no in-the-wild theft
What happened
GBHackers reports that older iPhones storing cryptocurrency recovery phrases remain at risk from BootROM vulnerabilities that cannot be patched, even after a wipe and with airplane mode on. According to GBHackers, OneKey founder Yishi Wang published a warning against treating retired iPhones as secure cold wallets. He points to hardware weaknesses that survive factory resets and that ordinary iOS updates cannot remove.
GBHackers names two exploits:
- checkm8, disclosed in 2019, which affects devices from the iPhone 4S through the iPhone X.
- usbliter8, a newer exploit that GBHackers says extends boot-chain compromise to A12 and A13 devices, including the iPhone XS, XR, iPhone 11 family and second-generation iPhone SE.
According to GBHackers, BootROM (also called SecureROM) is permanently embedded in the processor, so affected devices cannot receive a conventional software fix. For usbliter8, the outlet describes an attacker putting the device into Device Firmware Update mode and connecting specialized USB hardware, such as an RP2350-based microcontroller. Malformed USB setup packets then trigger a DMA pointer underflow that writes into memory used by SecureROM. GBHackers says the Data Address Resolution Table configuration on affected chips fails to contain those writes. A13 exploitation additionally requires bypassing Pointer Authentication.
GBHackers also states several limits on the risk. Physical access is required. Boot-level code execution does not by itself compromise the Secure Enclave or decrypt a recovery phrase. Device passcodes and wallet encryption remain meaningful barriers, particularly on newer affected models. The outlet says the risk grows when an owner combines an outdated iOS release, a weak passcode and a short wallet password. In that case, a wallet file protected only by a weak password could be guessed offline without the phone enforcing attempt limits.
The following details are not confirmed in the source:
- CVE identifiers.
- Who disclosed usbliter8, or when.
- Any statement from Apple.
- Any real-world theft using these techniques.
GBHackers separately mentions ChoiceJacking through malicious charging ports, where hostile USB accessories impersonate input devices. The outlet says this is distinct from BootROM exploitation.
Am I affected?
According to GBHackers, the following models are in scope:
- iPhone 4S through iPhone X (checkm8).
- iPhone XS, XR, iPhone 11 family and second-generation iPhone SE (usbliter8, A12 and A13).
Exposure depends on someone gaining physical access to the device. It also depends on additional weaknesses such as an outdated iOS release, a weak passcode or a weak wallet password. A full model list for usbliter8 beyond these examples is not confirmed.
What to do now
- If an affected iPhone holds a wallet seed, follow Wang’s recommendation as reported by GBHackers: create an entirely new recovery phrase in a trusted environment, then transfer your assets to it. Creating a new address under the same seed does not invalidate a stolen phrase.
- Keep physical custody of the device, since the described attacks need physical access.
- Use a strong alphanumeric passcode and a long wallet password.
- Keep iOS current, and use trusted charging equipment.
- For cold storage, consider newer hardware. GBHackers says newer hardware reduces exposure to these specific exploits.