Apple made it harder to hack an iPhone in iOS 18.1 - police aren't happy

In iOS 18.1, Apple introduced a feature that reboots the iPhone if it has not been unlocked for a certain period of time. This complicates law enforcement's access to data.

Previously, it was reported that law enforcement officials noticed that Apple iPhones stored for examination mysteriously rebooted themselves. At that time, the reason was unclear. The operating system's code causes the device to restart in a more secure state.

Apple indeed added a feature called «inactivity reboot» in iOS 18.1. This is implemented in keybagd and the AppleSEPKeyStore kernel extension. It seems to have nothing to do with phone/wireless network state. Keystore is used when unlocking the device.https://t.co/ONZuU9zVt2https://t.co/4ORUqR6P6Npic.twitter.com/O3jijuqpN0

— Jiska (@naehrdine) November 8, 2024

“Apple indeed added a feature called ‘inactivity reboot’ in iOS 18.1. This is implemented in keybagd and the AppleSEPKeyStore kernel extension. It seems unrelated to the phone or wireless network state. The key store is utilized when unlocking the device,” stated Dr. Jiska Claessen, head of a research team at the Hasso Plattner Institute in Germany. She also published screenshots of the recovered code.

In a closed chat among law enforcement and forensic experts, Christopher Vance, a forensic expert at Magnet Forensics, said:

“We discovered code in iOS 18 and later that is an inactivity timer. This timer will force devices in an AFU state to reboot to a BFU state after a specified time, which we have also determined.”

AFU stands for After First Unlock state — when someone, presumably the phone's owner, has unlocked the device at least once after it was powered on. This state facilitates the unlocking of the phone by law enforcement. BFU, before First Unlock state — occurs when the user has not unlocked the phone after it was turned on, which generally complicates matters.

“The reboot timer is not tied to any network or charging functions but is solely linked to the device's inactivity since the last lock,” Vance wrote.

Chris Wade, the founder of Corellium, mentioned that the iPhone reboots after being in a locked state for four days. Apple has yet to respond to inquiries regarding the reboots. Experts are urging law enforcement to collect evidence from phones as soon as possible.

Source: 404 Media