Apple released iOS 18.3.1 and iPadOS 18.3.1 today to fix a serious security problem related to USB Restricted Mode. This vulnerability could let someone bypass USB Restricted Mode on a locked device through a physical attack, which might allow access to the device’s data.

This new update fixes a security issue related to authorizations by managing states better. Bill Marczak found this vulnerability in The Citizen Lab at the University of Toronto. The original security measure was introduced in 2018 to keep data from being transferred via USB unless the device is unlocked. Apple mentioned that this vulnerability might have been used in advanced attacks against certain people.

The update can be installed on iPhone XS and newer models, as well as certain iPad models like the iPad Pro 13-inch, iPad Pro 12.9-inch (3rd generation and newer), iPad Pro 11-inch (1st generation and newer), iPad Air (3rd generation and newer), iPad (7th generation and newer), and iPad mini (5th generation and newer).

Apple usually keeps information about security vulnerabilities private until they have released fixes, so there’s no telling how long this has been an issue. This latest update builds on earlier fixes for USB Restricted Mode and works alongside a new feature in iOS 18 that restarts devices after they have been inactive for a few days, requiring a passcode to get back in.

The nature of the attack seems to show that the hacker needed to physically connect to the victim’s device using special tools. Although we don’t know who the attackers or victims are, it’s well-known that tools to unlock iPhones exist. Companies like Cellebrite and Graykey make forensic tools that law enforcement uses to unlock iPhones.

It’s likely the devices that were targeted faced a very advanced type of attack similar to those companies. So this update may also make things more difficult for law enforcement who want to unlock criminals’ iPhones, but that’s speculation because the specific details of the fix have not been disclosed.

Source: Apple, The Verge, TechCrunch