Apple has introduced a new security feature in its latest iPhone software that automatically restarts the phone if it hasn’t been unlocked for 72 hours, according to security experts.
Recently, 404 Media reported that some law enforcement officials and forensic specialists were puzzled by certain iPhones rebooting themselves unexpectedly. This behavior made it more challenging for them to access the phones and retrieve important data. After investigating, 404 Media found that this issue is linked to a new feature in iOS 18 called “inactivity reboot.” This feature automatically restarts the phone if it remains unlocked for three days.
On Wednesday, a researcher named Jiska Classen from the Hasso Plattner Institute shared a video showing how this “inactivity reboot” works. The video demonstrated that if an iPhone is left alone and not unlocked for 72 hours, it will reboot itself.
Magnet Forensics, a company that creates digital forensic tools for extracting data from iPhones and Android devices, also confirmed that the reboot timer is indeed set for 72 hours.
Read Also: Hyundai And Kia Recall 208,000 Electric Vehicles
The “inactivity reboot” feature enhances the security of iPhones by locking the encryption keys inside a special part of the phone known as the secure enclave chip. This means that even if a thief keeps the iPhone powered on for a long time, they won’t be able to unlock it using older, less sophisticated forensic tools. Classen mentioned on social media that while this feature complicates things for law enforcement trying to access data from criminals’ devices, it doesn’t completely prevent access. Three days is still a significant amount of time for professionals to coordinate their efforts to extract information.
To understand how this affects law enforcement and forensic experts, it’s important to know that iPhones have two different states that impact the ability to unlock them or retrieve data. These states are called “Before First Unlock” (BFU) and “After First Unlock” (AFU).
When an iPhone is in the BFU state, all the user’s data is fully encrypted, making it nearly impossible to access without knowing the user’s passcode. In contrast, when the phone is in the AFU state, some data is unencrypted, which means it could be easier for certain forensic tools to access, even if the phone is locked.
A security researcher known as Tihmstar explained that forensic companies often focus on “hot” devices in the AFU state because the user has already entered their passcode at some point, which is stored in the phone’s memory. On the other hand, “cold” devices, which are in the BFU state, are much harder to access since their memory is not easily retrievable after a restart.
Over the years, Apple has implemented various security features that law enforcement has criticized for making their jobs more difficult. For instance, in 2016, the FBI tried to force Apple to create a backdoor to unlock an iPhone belonging to a mass shooter, but in the end, they were helped by a startup called Azimuth Security to hack into the device.
Apple has not commented on this new feature or the concerns raised by law enforcement.
