Flipper Zero can be used to crash iPhones running iOS 17

Post by fragmede » Tue, Oct 17, 2023, 9:07 PM UTC

AshamedCaptain wrote: post #7

chatmasta wrote: post #4

Earlier quoted context omitted.

That's fine. I'm more concerned that the (replacement) hardware on my own device is not malicious, than I am with the hardware on other devices that are already outside my control. My trust model doesn't include them to begin with. And to the extent that my OS trusts those devices, at least any bugfixes can be pushed via software update. As the article notes, there is a simple way to stop this attack, which is to dis…

> That's fine. I'm more concerned that the (replacement) hardware on my own device is not malicious, than I am with the hardware on other devices that are already outside my control. You are more concerned with someone opening your iPhone and putting a replacement malicious part than with someone pwning your iPhone with a $5 wireless device while in his car just driving by ? Your threat model is upside down.

Post by AshamedCaptain » Tue, Oct 17, 2023, 9:11 PM UTC

chatmasta wrote: post #12

AshamedCaptain wrote: post #10

Earlier quoted context omitted.

> This is a DoS attack. It could never be perfectly mitigated Bullshit. Flooding the waves with radio interference (something that Bluetooth is particularly resistant to) would at most "deny service" of another device trying to connect to my iPhone through Bluetooth. It should NOT deny service of the _entire_ iPhone, which is what is discussed here. This is 100% preventable crap. > the (arguably) fundamentally imposs…

I agree with you, but that doesn't negate what I said about this being correctable in software. Whereas if someone implants a malicious HSM in my iPhone, or a screen that has a secondary chip connected to it recording everything I touch, then that's not correctable in software. It also does not qualify as "pwning" your device, at least for my interpretation of the word "pwn."

Post by chatmasta » Tue, Oct 17, 2023, 9:13 PM UTC

AshamedCaptain wrote: post #13

chatmasta wrote: post #12

Earlier quoted context omitted.

I agree with you, but that doesn't negate what I said about this being correctable in software. Whereas if someone implants a malicious HSM in my iPhone, or a screen that has a secondary chip connected to it recording everything I touch, then that's not correctable in software. It also does not qualify as "pwning" your device, at least for my interpretation of the word "pwn."

Your threat model is still ridiculously upside down. You are literally arguing that you are more worried about the possibility that someone subjects you to some type of maid attack (which requires an almost implausible level of dedication) rather than someone with a 5$ atmel chip claiming to be an Apple TV, automatically pairing with your device, and afterwards doing god knows what with it (including leaking more dat…

Post by lxgr » Tue, Oct 17, 2023, 9:19 PM UTC

chatmasta wrote: post #15

AshamedCaptain wrote: post #13

Earlier quoted context omitted.

Your threat model is still ridiculously upside down. You are literally arguing that you are more worried about the possibility that someone subjects you to some type of maid attack (which requires an almost implausible level of dedication) rather than someone with a 5$ atmel chip claiming to be an Apple TV, automatically pairing with your device, and afterwards doing god knows what with it (including leaking more dat…

I'm assuming I can opt-into the threat, i.e. it's possible for me to disable Bluetooth to remove my exposure to this class of attacks. When I turn on my WiFi I know that I'm subjecting myself to de-auth attacks, for example. I can't opt out of a hardware attack once a malicious repair shop has replaced a critical module in my phone with their own. Like I said, I'm more concerned with the latter. It doesn't mean I'm n…

Post by [deleted] » Tue, Oct 17, 2023, 9:33 PM UTC