IPhone found LPM vulnerability

Researchers from the Technical University of Darmstadt (Germany) discoveredEvil Never Sleeps: When Wireless Malware Stays On After Turning Off iPhones [PDF] Vulnerability in Low Power Mode (LPM) operation on the iPhone. It potentially poses a serious security risk, allowing attackers to run malware even on devices that are turned off.

The authors note that LPM, which is the subject of this study, should not be confused with iOS Low Power Mode, which is used to conserve battery power.

LPM mode appeared in iOS 15. It is activated when the smartphone is turned off - both manually by the user and automatically due to low battery. Although the device appears to be completely off, LPM continues to provide NFC, Ultra WideBand, and Bluetooth for 24 hours.

This ensures that Find My iPhone, digital car keys, and travel cards continue to work even after your device's battery dies.

The researchers believe that such a feature creates a new threat model. Since LPM support is implemented in hardware, it cannot be removed by changing software components. As a result, it is not possible to turn off all modules together with the smartphone.

According to the authors, the Bluetooth firmware is neither signed nor encrypted, which would allow an attacker to create malware capable of work on the iPhone's Bluetooth chip even when the device is turned off - for example, to track its location and share it with third parties persons.

However, in practice, the use of this exploit is an extremely difficult and time-consuming task. An attacker will have to gain physical access to the smartphone, hack it, jailbreak the iPhone, and only then gain access to the Bluetooth chip and use it.

In other words, although the feature improves the security of most users by allowing them to find a lost or stolen smartphone once turned off, it also potentially endangers users who may be subject to targeted attack.

The researchers informed Apple of their find, but at the time of publication of the report, they had not received a response from the company.