Some iOS users report that 11.4 update triggers excessive battery drain

Adjust Comment Print

Yesterday Apple released iOS 11.4.1, which is a small release that brings the new iOS 12 security feature back to iOS 11 users.

What ElcomSoft describes isn't a vulnerability per se, it's just a relatively-straightforward workaround for how the feature works.

The researchers were able to reset the one-hour counter for as long as you plug a USB accessory into the iPhone's Lightning port, The Verge reported.

More news: Julia Goerges advances to Wimbledon semi-final to face Serena Williams

After testing the latest build of iOS (11.4.1), researchers report that USB Restricted Mode does indeed persist across reboots and software restores. This prevents the USB Restricted Mode lock from turning after the one-hour timer.

You will now need to enter your passcode/pincode, then scroll down until you reach USB Accessories. This new mode, which is buried under your passcode settings, adds additional security to your iOS device by preventing USB accessories to connect with your iPhone or iPad if the device has been locked for more than one hour. Any USB accessory that connects to an iPhone over the Lightning port works, including Apple's own Lighting to USB 3 Camera adapter which is available for $39.

Apple is working away on iOS 12 at the moment, but it's still pushing out updates for iOS 11. Law enforcement and private companies could leverage the loophole and design new hardware to continue to crack passcodes through the Lightning port. It operates like this: if an iPhone or iPad is not unlocked after one hour, data access through the Lightning port will shut down. When you connect the iPhone to a computer, the two devices exchange cryptographic keys and establish trust.

More news: Judge cites 'real progress' in reuniting migrant families

With a power-transferring accessory, police - or other hackers - have a fairly straightforward means of accessing a seized iOS 11.4.1 device.

We've contacted Apple for comment and will update this post when we hear from them.

Apple curiously didn't include the security in the release notes, probably to not alert "interested parties". The only way for Apple to now fix this flaw would be to require authentication of all iPhone accessories, but this likely won't happen anytime soon.

More news: Thai Cave Rescue Operation Suspended After 4 More Boys Freed

If the countdown expires, USB Restricted Mode is still a good defense against hacks.