Usbliter8 iPhone BootROM Exploit Bypasses Apple's Secure Boot Chain

A Hardware-Level iPhone Vulnerability That Cannot Be Patched

A European cybersecurity research firm has disclosed a serious new iPhone BootROM exploit that cannot be fixed through a software update — putting millions of devices permanently at risk of low-level compromise. The exploit, dubbed Usbliter8, was revealed by Paradigm Shift and targets Apple's SecureROM, the foundational firmware code that runs the moment an iPhone powers on. For developers, IT security teams, and privacy professionals managing Apple devices, this disclosure is a significant event that warrants immediate attention.

Unlike typical software vulnerabilities that Apple can address with an iOS patch, this flaw is baked into the hardware itself — specifically into the System-on-Chip (SoC) of affected devices. That makes it structurally similar to the infamous Checkm8 exploit disclosed in 2019, which left an entire generation of iPhones permanently susceptible to jailbreak. The new Usbliter8 disclosure follows a familiar and troubling pattern: a hardware-level weakness that neither Apple nor its users can remediate through conventional means.

How the Usbliter8 iPhone BootROM Exploit Actually Works

To understand why Usbliter8 is so consequential, it helps to understand what SecureROM does. Apple's SecureROM — also called BootROM — is permanently embedded into the device's SoC and is the very first code that executes when an iPhone boots. It forms the root of Apple's entire secure boot chain: a series of cryptographic checks that verify each layer of software before allowing it to load. If the BootROM is compromised, every security assumption built on top of it collapses.

Usbliter8 chains two distinct weaknesses: a USB controller bug and a device firmware configuration flaw. By connecting a specially crafted USB device — such as a Raspberry Pi Pico 2 or a similar microcontroller board — to the target iPhone, an attacker can send malformed USB setup packets that trigger an out-of-bounds memory write. This allows the attacker to overwrite critical data in memory, escalate privileges, and ultimately execute arbitrary code at the device's lowest level — before the operating system ever loads.

The result is a full bypass of Apple's signature verification checks. A successful Usbliter8 attack allows an attacker to load unsigned firmware, modify security settings, or otherwise take control of the processor at the hardware level. Crucially, the attack requires physical USB access to the device — it cannot be launched remotely. This limits the attack surface considerably, but does not eliminate the risk, particularly in contexts involving border crossings, device confiscation, supply chain interference, or forensic analysis scenarios.

Affected devices include iPhones running Apple's A12 and A13 chips — the iPhone XS, XR, and iPhone 11 series — and Apple Watches with S4 and S5 chips. These chips were released in 2018 and 2019, and represent a substantial portion of the global iPhone install base that remains in active use today.

Does Usbliter8 Compromise User Data? The Secure Enclave Question

One of the most pressing questions for privacy professionals and IT decision-makers is whether this exploit can directly expose user data. According to Paradigm Shift's disclosure, the Usbliter8 exploit does not directly compromise Apple's Secure Enclave Processor (SEP) — the dedicated security chip that protects sensitive data including biometrics, encryption keys, and payment credentials.

This is an important but nuanced distinction. While the exploit cannot be used to directly extract user data from the Secure Enclave, gaining full code execution at the BootROM level creates a powerful foundation from which more sophisticated attacks can be staged. Once an attacker controls the pre-OS environment, they can potentially load malicious firmware, manipulate the boot sequence, or create conditions that make subsequent Secure Enclave attacks more feasible. As noted by security researchers at Paradigm Shift, it "opens up wider attack vectors" — which is precisely the language that should prompt organisations to reassess their threat models for affected devices.

For enterprises operating under GDPR obligations or managing sensitive data on behalf of EU citizens, the emergence of a hardware-level exploit — even one that requires physical access — raises meaningful compliance and risk management questions. A device that cannot be patched represents a permanent gap in any device security policy.

Usbliter8 vs. Checkm8: How Does This Compare to the 2019 BootROM Exploit?

The cybersecurity community has been quick to draw comparisons to Checkm8, the landmark BootROM exploit disclosed in 2019 by researcher axi0mX. Checkm8 affected devices with chips ranging from A5 to A11 — covering iPhones from the 4S through the iPhone X — and similarly could not be patched via software. It became the basis for the popular checkra1n jailbreak and was later adopted by commercial forensic tools used by law enforcement agencies worldwide, as documented extensively by cybersecurity journalists at Wired.

Usbliter8 picks up where Checkm8 left off in terms of chip generations. Where Checkm8 covered devices up to A11, Usbliter8 now extends hardware-level exploitation capability to A12 and A13 devices. Together, these two exploits establish a near-continuous chain of hardware-level vulnerability across many years of iPhone production — a sobering reality for anyone responsible for securing a fleet of older Apple devices.

Why Forensic Vendors and Enterprise Security Teams Should Take Notice

While the requirement for physical USB access significantly limits opportunistic exploitation, it does not reduce the threat in all contexts. As reported by SecurityWeek, this type of exploit is particularly valuable to digital forensics vendors — companies that develop tools for law enforcement and government agencies to extract data from seized devices. The Checkm8 precedent already demonstrated this pathway clearly: within months of that disclosure, commercial forensic platforms had integrated the exploit into their toolkits.

For enterprise IT decision-makers, the practical implications are several. First, any organisation with a policy of reusing older iPhone hardware — a common cost-saving measure in SMEs and non-profits — should reassess whether affected devices (iPhone XS, XR, 11 series) are appropriate for roles involving sensitive data. Second, mobile device management (MDM) solutions cannot protect against pre-OS attacks; this class of exploit operates beneath the layer where MDM tools function. Third, organisations subject to GDPR, NIS2, or similar regulatory frameworks may need to document this known unpatched vulnerability as part of their risk registers.

For privacy-conscious users and professionals managing personal data, the key practical takeaway is straightforward: a device running on A12 or A13 chips that falls into the wrong hands physically is potentially exploitable at the hardware level. While the Secure Enclave provides a meaningful barrier to direct data extraction, the attack surface has measurably expanded. Upgrading to devices with newer chip generations — A14 and beyond — is the only structural mitigation available.

Responsible Disclosure: What Paradigm Shift Did and Why Apple's Silence Matters

Paradigm Shift followed responsible disclosure practices, notifying Apple of the vulnerability before publishing its research. According to the original SecurityWeek report, Apple had not publicly responded to the findings at the time of disclosure. SecurityWeek noted it had contacted Apple for comment. This silence from Apple is not unusual for hardware-level vulnerabilities where no patch can be issued, but it does leave the security community — and affected users — without official guidance.

The decision to release proof-of-concept (PoC) code alongside the disclosure is consistent with a transparency-first approach to hardware security research. As the Paradigm Shift team explained in their disclosure: "By publishing this research and the accompanying proof of concept, we aim to document the real-world impact of this class of hardware vulnerabilities, contribute to the broader

Originally reported by Security Week. Summarised and curated by European Purpose.