On Monday, Apple announced updates for its iPhone and iPad software, known as iOS and iPadOS. These updates were important because they fixed a security issue that Apple warned could have been exploited in very advanced attacks aimed at specific people.
In the details about the new versions, iOS 18.3.1 and iPadOS 18.3.1, Apple explained that this security flaw made it possible for someone to turn off a safety feature called USB Restricted Mode on a locked device. This feature, which Apple introduced in 2018, is designed to protect your information by preventing data from being transferred through a USB connection if the device hasn’t been unlocked for seven days. Additionally, Apple added another layer of security last year that automatically restarts devices if they haven’t been unlocked for 72 hours. This makes it more difficult for both police and criminals using special tools to access the data on those devices.
Apple’s description of the security issue suggests that the attacks likely required the attacker to have physical access to the targeted person’s device. In other words, the person trying to exploit this flaw would need to connect their equipment directly to the victim’s iPhone or iPad. They might use forensic tools like Cellebrite or GrayKey, which are systems often used by law enforcement to unlock devices and retrieve the data stored on them.
Read Also: TikTok Stars Are Wearing Apple Watches On Their Ankles
The vulnerability was found by Bill Marczak, a senior researcher at Citizen Lab, a group at the University of Toronto that studies cyberattacks against individuals and organizations working for civil rights.
As of now, it’s not clear who was using this flaw or who their targets were. However, there have been previous instances reported where law enforcement agencies used forensic tools to exploit security weaknesses in devices like the iPhone to unlock them and access personal information.
For example, in December 2024, Amnesty International published a report detailing how Serbian authorities used Cellebrite to unlock the phones of activists and journalists. After unlocking these devices, they allegedly installed malware on them to monitor or control the individuals.
Security experts believe that forensic tools like Cellebrite are being used extensively against people in civil society, which raises serious concerns about privacy and security.
