checkm8 IOS Vulnerability | Mobile Threat Defense Needs

On September 27th, an independent iOS security researcher using the Twitter handle axi0mX reported on checkm8. Described as “permanent unpatchable bootrom exploit” for any iOS device with an A5 chip (iPhone 4s/iPad 2) up to an A11 chip (iPhone X), this vulnerability could have serious security implications for anyone using devices with these chips. This exploit also opens the door for iOS users to jailbreak their own devices, without the fear of being “patched” by a subsequent iOS update. However,  the only way to take advantage of this exploit is via USB, so the attacker must have physical possession of the device in order to cause harm. 

Since the vulnerable code is hard-coded to the chip in the device, there is no way for Apple to patch this. Based on millions of iOS users that have installed Lookout and Lookout for Work apps, more than 80% of iPhones are vulnerable. This vulnerability raises the stakes of losing physical possession of your device.

‍

About checkm8 vulnerability 

The checkm8 vulnerability is exposed in the Device Firmware Upgrade (DFU) mode of iOS devices running A5 through A11 chips. In terms of iPhone models, this is anything from the 4S through the X. Since DFU mode is not accessible from a fully-booted device and is normally triggered from a powered-off state using button inputs similar to restore mode, the only way for the attacker to take advantage of the vulnerability is through USB. There is no way to exploit this vulnerability in a remote Pegasus-like fashion. 

Once exploited, an attacker can run any code on the device, including a modified or outdated version of iOS that Apple no longer supports, and potentially insert some sort of backdoor using that modified version. For example, a modified operating system could be booted to support cracking the passcode by trying all possible passcode combinations. For a six-digit passcode, which is the most commonly used on iOS devices, this would only take a few seconds. By doing so, the attacker would then have access to anything and everything on the device. 

However, an operating system modified by the attacker will not persist past a reboot, but the attacker could persist on the device by sideloading an app on it. A reboot of the device will therefore return the device to a trusted iOS image but the attacker may yet maintain some level of access. And, any data that was on the device at the time of exploit should be considered compromised. 

‍

Mobile Threat Defense solution: Protection from the checkm8 vulnerability

An open-ended exploit like checkm8 highlights the need for a Mobile Threat Defense (MTD) solution, with multi-layered coverage across the entire spectrum of mobile risk. Once the device is compromised in an attack such as this, the most likely actions would be the following, all of which Lookout detects:

1. Loading an outdated version of iOS that Apple no longer supports
2. Load a jailbroken version of the currently supported versions of iOS
3. Sideload an application as a means of persisting on the device past reboot
   

In general, users who lose physical access to their iOS device for a period of time should reboot it, even though the data on the device may already be compromised.  And, organizations should consider putting a standardized policy or process in place for any device that was out of a user’s control for a certain amount of time. This process should include resetting the device password, cycling multi-factor authentication (MFA) tokens, and/or blocking access to corporate apps and infrastructure for a certain amount of time. 

Learn more about how Lookout Mobile Endpoint Security can protect against device vulnerabilities.