Hacker Newsnew | past | comments | ask | show | jobs | submit | FluGameAce007's commentslogin

Disables request signing if the config “Bag” fails to load (e.g. DNS block, timeout).

Unsigned requests are sent directly to Apple APIs. No fallback, no integrity checks. Replay and downgrade attacks are possible.

Includes syslog evidence + PoC sketch: https://github.com/JGoyd/ams-failopen

Not theoretical — this was observed live in the wild.


But the issue isn't about parsing log semantics...

It's that a production device entered a state where normally fused-off debug logic became accessible. That shouldn’t be possible, regardless of how the logs were captured or named.


Get off the slop generator for a moment and look up who ‘comex is. Then stop submitting AI slop articles to this site (and better yet, stop writing them at all). If you really care about security research for Apple platforms, learn how to do it properly and find your own bugs instead of posting clearly bogus content.


The device "recovering" while entering debug mode on production hardware is the security issue. Fuses are supposed to prevent that. They don’t. That’s the flaw.


If I own an iPhone 15 Pro, how am I impacted by this? Why does this repo say that a hardware recall may be necessary?


If debug logic is still active, attackers with physical access can dump firmware, extract secrets, or bypass protections that should be fused off.

Think: stolen phones, shady repair shops, or border checks — cases where physical access + this flaw = real risk.

That’s why a hardware recall may be necessary... fuses are meant to be irreversible. If they fail, there's no patch.


If a circuit breaker melts and causes other circuits to misbehave, we don’t say “big whoop”... we call it a fire hazard.


Yes, it’s a security flaw, because debug logic is active on production hardware that should have it permanently fused off.

Worse, the system prunes logs aggressively, erasing the very diagnostic history that could expose this behavior. So not only is debug logic unintentionally enabled, the evidence is self-erasing.


This isn't just a bug... it's a hardware-level oversight that can cause iPhones to silently fail during boot, leaving no logs, no recovery mode, and no forensic trace.

The flaw is triggered by abrupt power loss (e.g. during brownouts or unstable charging), preventing the secure world and logging subsystems from initializing. Confirmed it on real A17 Pro device.

Curious if others can reproduce this, or if similar behavior exists in M-series chips.


Shared resources isn't a "hardware bug." It's a design choice.

I2C is always vulnerable to one device locking up the bus-- indeed almost all buses are. But it's intended to be a bus hooking up multiple pieces of hardware.

This is an interesting phenomenon-- source account is 100% dubious Apple "bug reports" and then we have another completely new account choosing to misinterpret the dubious report (which isn't really security related despite involving a security component) as a critical vulnerability. The cited reports all ring like they're written by a LLM.


True.. I2C lockups are a known limitation, not a bug. But this isn’t about bus contention. The issue is that debug logic is active on production-fused silicon, despite dev-fused = 0 and debug = 0x0. That’s a hardware trust failure, not a design trade-off. Fuses are supposed to make debug paths unreachable—but they’re not. That’s the problem.


There's no secure enclave output here. Stop the bogus reports.

If I want to talk to ChatGPT, I'll go to the site or use the API kthx.


You're absolutely right! This isn't just X, it's Y...


That looks very much like "just a bug" to me.

Long press hard reboot should rectify that if the device isn't severely damaged in a way that causes permanent instability on I2C4. And if it is, then welcome to board level repair, here's your introductory can of pickled suffering.

Now, if you could use that to pwn SEP? Or boot into a custom ROM, checkm8 style? That would be something. But I see zero evidence of this being exploitable in any way.


If debug logic can be reactivated... even briefly, even locally; then all bets are off for things like firmware extraction, secure boot bypass, or SEP fault analysis.


Debug logic reactivated? Show me JTAG then.


Observed on a production-fused A16 Bionic devices (e.g., iPhone 14 Pro Max),the internal debug pathways activating under stock iOS (debug = 0x0, dev-fused = 0). SecureROM, firmware, and co-processors all exhibit debug behavior without jailbreak, tampering, or provisioning profiles.

This violates Apple’s hardware trust model and exposes internal diagnostics meant for development silicon.


I'll link my favorite computing journal, and cite its title here:

PoC || GTFO [0].

[0]:https://www.alchemistowl.org/pocorgtfo/


This post details an active vulnerability chain on iOS 18.6.2 involving malformed Siri Shortcuts that persist in the background, abuse system daemons, and tolerate TLS trust mismatches. Full report with logs and CVSS scoring available on GitHub. Reproducible in production


A forensic analysis of iOS 18.6 reveals a silent data exfiltration sequence initiated entirely by Apple system daemons — no app involved, no permission prompt, no UI indicator. In a ~3-second window, nsurlsessiond and symptomsd transferred ~5MB of data over the network. This activity is not tied to any userland app, does not trigger any TCC prompt, and cannot be viewed or controlled in iOS privacy settings.

Sequence of events:

tccd preflights access to Reminders (TCC-protected) with no app context

abm-helper, CommCenterRootHelper, and cfprefsd coordinate via Mach/XPC

sosd attempts to write to a sensitive communications safety plist

nsurlsessiond purges its cache

symptomsd logs 5MB+ of RX/TX traffic — with no app running

There is:

No telemetry toggle

No EDR/MDM visibility

No disclosure from Apple

This breaks the app-based sandbox and represents:

A system-native stealth exfil pipeline

Cross-daemon privilege chaining

A real privacy and compliance blind spot


"Preflight=yes" bypassing user prompts is not expected or documented behavior... period.

The fact that internal system daemons can silently trigger access to TCC-protected domains (like Contacts, FaceID, Microphone, and Bluetooth) without app association or user consent breaks Apple’s own stated privacy model.


It's very possible they have good reason to do so. Phone app needs contact access to display CallerID and Microphone access to allow me to answer my call

This got flagged because you have not proven anything.

System Level Daemons and preinstall Apple developed applications are bypassing standard app level permissions. Are they doing anything nefarious with the data like sending it all to Apple or just using it to do the work people expect? You are running around acting like SystemD is doing nefarious stuff because it's bypass file permissions. Ok, it's a system daemon, not shocked, is it doing anything bad with that or just trying to make my system work out of the box as I expect.

Apple makes OS on the iPhone, they are in privileged spot.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: