A team of security researchers operating under the name Paradigm Shift has released a working proof-of-concept exploit, dubbed usbliter8, that achieves arbitrary code execution within the SecureROM of Apple's A12 Bionic and A13 Bionic system-on-chip designs. The exploit targets code burned directly into the silicon at manufacture — code that no software update can ever reach or modify.
What Is SecureROM?
SecureROM (also called the Boot ROM or BootROM) is the first code that executes when an Apple device powers on. It is:
- Read-only — written into the chip at the factory and cannot be changed afterward
- The root of trust — it verifies the signature of every subsequent boot stage before allowing it to run
- The foundation of Apple's Secure Boot chain — if SecureROM is compromised, everything built on top of it (including iOS security, Secure Enclave protections, and data encryption) becomes suspect
A vulnerability in SecureROM is therefore qualitatively different from a typical software flaw. Software bugs can be patched. Silicon cannot.
What usbliter8 Does
The usbliter8 exploit achieves arbitrary code execution in the SecureROM context by exploiting a flaw in the USB Device Firmware Upgrade (DFU) stack built into the A12 and A13 chips. According to the researchers:
- The vulnerability exists in the USB DFU protocol handler within the chip's immutable code
- An attacker with physical access to the device can trigger the flaw via a USB connection while the device is in DFU recovery mode
- Successful exploitation grants full code execution at the lowest privilege level of the device's boot chain, before any iOS or kernel code has loaded
- This allows an attacker to bypass all software-based security controls, including Secure Boot, Pointer Authentication Codes (PAC), and the Secure Enclave Processor (SEP)
The name usbliter8 is a play on "USB" combined with "literate" — a reference to being able to read and write to parts of the device's boot chain that are normally completely protected.
Affected Devices
Devices powered by Apple's A12 and A13 Bionic chips include:
A12 Bionic:
- iPhone XS, XS Max, XR
- iPad Pro (3rd generation, 11-inch and 12.9-inch, 2018)
- iPad Air (3rd generation)
- iPad Mini (5th generation)
- iPod touch (7th generation)
A13 Bionic:
- iPhone 11, 11 Pro, 11 Pro Max
- iPhone SE (2nd generation)
- iPad (9th generation)
Devices using Apple's A14 Bionic and later chips are not affected, as Apple redesigned the DFU USB stack for those generations.
Implications
There Is No Patch
This is the critical distinction between usbliter8 and virtually every other security vulnerability. Because the flaw exists in immutable ROM code, Apple cannot issue a software update that fixes it. Every affected device will carry this vulnerability for its entire operational lifetime.
Apple's own history with SecureROM vulnerabilities — most notably the checkm8 exploit published in 2019, which targeted A5 through A11 Bionic chips — demonstrates both the severity of such flaws and the impossibility of remediation.
Physical Access Required
Unlike remote exploits, usbliter8 requires the attacker to have physical access to the device and the ability to put it into DFU mode. This significantly limits the threat surface in practice.
However, the physical access requirement does not eliminate risk in scenarios such as:
- Border crossings and customs inspections by governments that may compel device access
- Device seizure by law enforcement
- Lost or stolen devices that fall into sophisticated adversaries' hands
- Supply chain scenarios involving device interception
Jailbreaks and Unlocking
In the security research community, SecureROM exploits have historically enabled untethered jailbreaks — the ability to run arbitrary software on a device without Apple's authorization. The checkm8 exploit became the foundation for the checkra1n jailbreak. It is expected that usbliter8 will enable similar capabilities for A12 and A13 devices.
Forensic and Investigative Use
Law enforcement and intelligence agencies may leverage exploits like usbliter8 to extract data from encrypted Apple devices. This raises significant privacy and civil liberties concerns, particularly for activists, journalists, and dissidents in jurisdictions where such capabilities might be misused.
Apple's Response
At the time of publication, Apple has not issued a formal statement regarding usbliter8. The company has historically acknowledged SecureROM vulnerabilities with a statement noting that the issue "cannot be fixed" for affected devices while confirming that newer generations are not impacted.
What Users Can Do
While affected devices cannot be patched, users can reduce their risk:
- Enable a strong alphanumeric device passcode — this prevents trivial data extraction even if boot chain access is achieved
- Enable Stolen Device Protection (iOS 17.3+) — adds additional friction to account access from unfamiliar locations
- Keep devices physically secure — the exploit requires physical access; do not leave devices unattended in high-risk environments
- Consider upgrading to A14 or newer hardware — if operating in a high-threat environment (journalism, activism, corporate espionage risk)
- Enable Full Disk Encryption — already enabled by default on modern iOS; ensure it remains active
The broader takeaway is a reminder that silicon-level security boundaries, once breached, are permanent — underscoring the importance of chip-level security design in modern hardware.