People store a lot of sensitive information on their phones and iPhones are big targets for phone theft. Physical access is quite easy once the device is snatched from the owner’s hands.
quick_snail@feddit.nl 3 days ago
This requires physical access. I don’t get it, why is this bad?
Someone with physical access can already pull out the disk, clone it, and put in a different disk that boots to an identical looking login, but which actually relays the password back to the attacker.
What more would this exploit allow an attcker with phsycal access thay wouldn’t already have before this exploit?
LemmyEntertainYou@piefed.social 2 days ago
DdCno1@beehaw.org 2 days ago
An attack via USB is much sneakier to pull off (no device surgery required) and more difficult to combat as an org. You essentially have to epoxy the ports shut or remove them physically and force your employees to charge their phones and tablets wirelessly. Not an usual thing to do - I first saw this decades ago with PCs and laptops - but still.
Fun fact: With laptops commonly using USB ports for charging these days, higher-end business-oriented ones tend retain the old barrel plug so that they can still be used with USB ports being rendered inoperable.
Slightly off-topic: One of my last employers used software (I think it was a built-in utility of HP business computers) to disable USB ports on laptops instead, primarily to stop people from using insecure USB drives (only people working on really sensitive stuff had the ports epoxied). There was an internal file sharing service that was meant to be used in place of tiny drives you can accidentally lose, but it worked exceptionally poorly. They forgot that you can still transfer files via Bluetooth to virtually any other Bluetooth device that has storage, which is what I resorted to. It’s slow, but reliable, works with anything (even old dumb phones) and is of course not as stupid as using a commercial cloud service, which is what some of my colleagues did.
quick_snail@feddit.nl 2 days ago
I think a lot of companies use EDR to software disable USB ports. But I wouldn’t recommend it.
Stiggyman@ani.social 2 days ago
Disk? This is iPads and iPhones shits soldered on there typically right next to or inside the SOC