Man
Professional
- Messages
- 2,965
- Reaction score
- 488
- Points
- 83
Law enforcement and forensic experts are concerned about the strange behavior of the iPhone, apparently related to the release of iOS 18. It turned out that devices reboot on their own if they have not been connected to the network of a mobile operator for some time. This seriously complicates the subsequent unlocking of such phones, for example, confiscated from criminals.
According to 404 Media, its editors have at their disposal a document in which law enforcement officials warn their colleagues and forensic experts that iPhones stored awaiting examination can reboot on their own. As a result, the devices return to a state in which they are much more difficult to unlock.
It has not yet been possible to establish the exact cause of such reboots. The authors of the document (unnamed law enforcement officials from Detroit) suggest that Apple developers may have implemented a new security feature in iOS 18 that causes iPhones to reboot if they are disconnected from the cellular network for a while.
"The purpose of this notice is to draw attention to the situation with the iPhone, due to which devices reboot after a short period of time (according to observations, probably within 24 hours) when away from the cellular network," reads the document obtained by reporters from an unnamed source working in the field of mobile forensics.
It is noted that the authenticity of the document was confirmed by a second anonymous source, who even sent journalists a small fragment of the same document as evidence.
Law enforcement officers write that they faced a problem, as their digital forensics laboratory stored several iPhones that were in the "After First Unlock" (AFU) state. At the same time, some iPhones were in airplane mode, and one was even in a Faraday cage.
AFU means that since the last time the device was turned on, someone (usually the owner himself) has unlocked it at least once using a passcode or other means. Typically, law enforcement agencies and experts access devices using specialized tools (e.g., Cellebrite) precisely in the AFU state.
However, after an unexpected reboot, the iPhone goes from the AFU state to the "Before First Unlock" (BFU) state. According to the document, this is significantly complicated by the subsequent hacking of the device using the tools available to forensic experts.
Excerpt from the document
The document says that three iPhones running iOS 18.0 entered the lab on October 3, 2024. The law enforcement hypothesis states that in the event of certain conditions, "iPhone devices with iOS 18.0 on board delivered to the laboratory communicated with other iPhone devices in storage that were turned on and in AFU mode. Thanks to this communication, the devices were sent a signal to reboot if a long time had passed since the last time the device was active or offline." Moreover, it is assumed that this could apply not only to iPhones running iOS 18.0, which arrived at the laboratory as evidence, but also to the personal devices of the specialists themselves.
At the end of the document, experts give recommendations for their colleagues and ask to disseminate information about the problem among other criminologists and investigators. Thus, the authors of the notification advise not to expose devices in AFU mode to "exposure to iOS 18", isolate them and, in any case, take an inventory of all AFU devices.
Matthew Green, a well-known information security expert and cryptographer at John Hopkins University, told the publication that everything described in the document is "strange and surprising," and the hypothesis of law enforcement officers seems to him "deeply suspicious."
"The idea that phones should periodically reboot when there is no network for a long time is absolutely brilliant, and I would be amazed if Apple really did it intentionally," Green said.
Apple did not respond to a question from reporters about whether iOS 18 really has some new protection that can cause devices to reboot on their own.
According to 404 Media, its editors have at their disposal a document in which law enforcement officials warn their colleagues and forensic experts that iPhones stored awaiting examination can reboot on their own. As a result, the devices return to a state in which they are much more difficult to unlock.
It has not yet been possible to establish the exact cause of such reboots. The authors of the document (unnamed law enforcement officials from Detroit) suggest that Apple developers may have implemented a new security feature in iOS 18 that causes iPhones to reboot if they are disconnected from the cellular network for a while.
"The purpose of this notice is to draw attention to the situation with the iPhone, due to which devices reboot after a short period of time (according to observations, probably within 24 hours) when away from the cellular network," reads the document obtained by reporters from an unnamed source working in the field of mobile forensics.
It is noted that the authenticity of the document was confirmed by a second anonymous source, who even sent journalists a small fragment of the same document as evidence.
Law enforcement officers write that they faced a problem, as their digital forensics laboratory stored several iPhones that were in the "After First Unlock" (AFU) state. At the same time, some iPhones were in airplane mode, and one was even in a Faraday cage.
AFU means that since the last time the device was turned on, someone (usually the owner himself) has unlocked it at least once using a passcode or other means. Typically, law enforcement agencies and experts access devices using specialized tools (e.g., Cellebrite) precisely in the AFU state.
However, after an unexpected reboot, the iPhone goes from the AFU state to the "Before First Unlock" (BFU) state. According to the document, this is significantly complicated by the subsequent hacking of the device using the tools available to forensic experts.
Excerpt from the document
The document says that three iPhones running iOS 18.0 entered the lab on October 3, 2024. The law enforcement hypothesis states that in the event of certain conditions, "iPhone devices with iOS 18.0 on board delivered to the laboratory communicated with other iPhone devices in storage that were turned on and in AFU mode. Thanks to this communication, the devices were sent a signal to reboot if a long time had passed since the last time the device was active or offline." Moreover, it is assumed that this could apply not only to iPhones running iOS 18.0, which arrived at the laboratory as evidence, but also to the personal devices of the specialists themselves.
At the end of the document, experts give recommendations for their colleagues and ask to disseminate information about the problem among other criminologists and investigators. Thus, the authors of the notification advise not to expose devices in AFU mode to "exposure to iOS 18", isolate them and, in any case, take an inventory of all AFU devices.
Matthew Green, a well-known information security expert and cryptographer at John Hopkins University, told the publication that everything described in the document is "strange and surprising," and the hypothesis of law enforcement officers seems to him "deeply suspicious."
"The idea that phones should periodically reboot when there is no network for a long time is absolutely brilliant, and I would be amazed if Apple really did it intentionally," Green said.
Apple did not respond to a question from reporters about whether iOS 18 really has some new protection that can cause devices to reboot on their own.
