Researchers Uncover Unpatchable BootROM Exploit Targeting Apple’s A12 and A13 Chips
Security research firm Paradigm Shift has published details of a new BootROM vulnerability affecting Apple’s A12 and A13 chips, along with a working proof-of-concept exploit named "usbliter8." Because the BootROM, also known as SecureROM, is baked directly into the chip at manufacture, any vulnerability found in it cannot be fixed with a software update, leaving affected devices exposed for the rest of their operating lives.
What did Paradigm Shift disclose?
Paradigm Shift published a new BootROM vulnerability, demonstrated through a working proof-of-concept exploit called "usbliter8," that targets Apple’s A12 and A13 chips. The flaw is unpatchable because the BootROM, also known as SecureROM, is baked directly into the chip at manufacture and cannot be repaired through software updates.
How does usbliter8 work?
The exploit targets a bug in the USB controller hardware built into Apple’s A12 and A13 chips. When an iPhone receives USB data during startup, the controller uses a memory buffer to store incoming packets. Paradigm Shift discovered that by sending a specific sequence of unusually small packets, they could manipulate an internal hardware pointer so that it walks backwards through memory, allowing data to be written to locations it should never reach.
The researchers say this appears to be a hardware-level bug in the USB controller, not a software flaw. That distinction is what makes the issue unpatchable: the BootROM code lives in read-only memory on the silicon itself.
Which devices are affected?
usbliter8 covers the next generation of Apple silicon after the previous well-known exploit, "checkm8," which was disclosed in 2019 and affected devices from the iPhone 4S through the iPhone X. The new exploit reaches the iPhone XS, iPhone XS Max, iPhone XR, the entire iPhone 11 family, and the second- and third-generation iPhone SE models that use these chips.
The A11 chip used in the iPhone X is not affected because its USB driver manually resets the pointer after each packet. A14 and later chips are also safe, since they configure a memory protection feature correctly at the BootROM level. The A12 and A13 sit in a vulnerable middle ground between the two.
What happens after code execution?
On A12 devices, gaining code execution is relatively straightforward. On A13 devices it is considerably harder, because Apple introduced Pointer Authentication Codes (PAC), a security feature that detects and blocks certain types of memory tampering. Working around PAC on the A13 required the researchers to follow a multi-step process before they could take control of the processor.
Once execution is achieved, the exploit installs a custom handler that survives a device restart and adds two capabilities: temporarily lowering the device’s security settings, and booting unsigned software without any verification checks. As a convention carried over from checkm8 and earlier exploits, it also injects the string "PWND" into the iPhone’s USB serial number to signal that the device has been compromised.
What about the Secure Enclave and disclosure?
Paradigm Shift notes that while usbliter8 does not affect the Secure Enclave directly, a BootROM compromise of this kind opens up wider avenues for attacking it. The firm says it reported its findings to Apple Product Security before publication and worked with Apple on a coordinated disclosure timeline. The full proof-of-concept code is available at ps.tc alongside the technical write-up.
The findings underline a recurring reality of low-level device security: once a vulnerability is discovered in the immutable code that boots a device, every device using that silicon remains vulnerable until it is retired.
FAQ
What is usbliter8?
usbliter8 is a proof-of-concept BootROM exploit published by security research firm Paradigm Shift. It targets a hardware-level bug in the USB controller of Apple’s A12 and A13 chips and is unpatchable because the BootROM is baked into the silicon at manufacture.
Which iPhones are vulnerable to usbliter8?
The exploit affects iPhones powered by Apple’s A12 and A13 chips, including the iPhone XS, iPhone XS Max, iPhone XR, the entire iPhone 11 family, and the second- and third-generation iPhone SE models. The A11 in the iPhone X and A14 and later chips are not affected.
Can Apple fix the usbliter8 vulnerability?
No. Because the BootROM lives in read-only memory on the chip itself, the vulnerability cannot be addressed through a software update. Every device using A12 or A13 silicon remains exposed for the rest of its operating life.