Researchers Invent iPhone Malware That Works Even When The Phone Is Off

Contrary to popular belief that iPhones are the most unshakeable phones out there, they are still prone to malware. Now, if you were to discover malware on your iPhone, your instincts would kick in, and you might go for the good, old ‘turn the phone off’ trick. But that might just not be enough!

As scary as it sounds, researchers at the Technical University of Darmstadt have developed a new kind of malware that functions even when your iPhone is off. ‘How can malware run without power?’ we thought you’d ask! The most straightforward answer to this is that mobile phones aren’t turned off completely these days.

How the iPhone Malware Works

After the iOS 15 update, iPhones remain ‘locatable’ through Bluetooth, even after you may have shut them down. The malware takes advantage of the iPhone’s Low Power Mode – which has worked with every iPhone since 2018 (starting from iPhone Xs and XR).

This feature allows the NFC, Bluetooth, and Ultra-Wideband chips to take a little bit of power, even with a turned-off main processor. These chips can then run indefinitely, making your traceable phone through the ‘Find My’ feature and keeping facilities like Car Key and Express Cards functional.

All of this may sound useful if you ever lose your iPhone, but it also opens the device up for potential malware that can run until your battery runs out.

The Bluetooth chip comes with its firmware, which runs separately from the main processor. According to researchers, this firmware is the fundamental part of the study, as it has no protection against alterations and is completely unsigned.

This means that attackers could run Bluetooth malware even on a turned-off iPhone. In an attempt to secure Apple’s NFC chip that stores information for Car Keys, Express Cards, and Apple Pay, the UWB and Bluetooth chips are hardwired.

Hence, the hackers can access the Secure Element’s information by attacking the firmware of the Bluetooth chip. To make matters worse, since the LPM support is used in hardware, it cannot be removed simply by updating the system. This means that firmware-level hacks that leverage low power modes could be tough to detect. You can locate malware because it drains more battery.

All Hope is Not Lost.

But, it is not all bad! It is pertinent to mention here that the malware mentioned needs a jailbroken iPhone, cutting down the chances of regular users being affected by it.

The researchers have shared their discovery with Apple, meaning the company will address these concerns on future devices. Still, this goes on to show that with every new feature, there are opportunities that ‘hackers’ can exploit. And, with every possible stunt made early, there are many that we don’t discover until it is too late.