Newly Discovered iPhone Attack Vector Can Be Used to Spy on Victims

Security researchers working with ZecOps have discovered a new proof of concept attach vector that ultimately allows potential threat actors to spy on you using your iPhone's camera and microphone.

The new attack is named 'NoReboot' and was researched and discovered by a security team, as a proof of concept, which means it was not spotted in the wild, being used by hackers.

Quiet Persistence

The attack uses a method to achieve persistence on the targeted device by faking a device reboot and can thus keep malicious processes and activity active, while to the user, it seems that the device has been rebooted as normal.

NoReboot makes it look like your iPhone is rebooting as normal. However, the shutdown is fake and it leaves the microphone and camera on the phone exposed for hijacking. NoReboot injects malicious code into several background process daemons on the iPhone, namely backboardd, InCallService and SpringBoard.

The audio-visual elements that are included in an iPhone's reboot process such as the animated spin can all be hijacked using the injected malicious code. According to the security researchers who developed the proof of concept attack, a fake reboot triggered by NoReboot is visually indistinguishable from a real one. However, in the fake one, the device remains connected to the service provider.

The attack includes methods to also trigger a false reboot before a real forced restart is triggered, which makes it even more dangerous.

Not Very Easy to Fix

The attack could be effectively used by potential threat actors to achieve persistence while simultaneously tricking the user into thinking their device has been rebooted. According to ZecOps, the issue will be hard to fix with a simple patch, due to the fact that it relies on tricking the user into thinking something has happened normally, while it really hasn't - the entire purpose of the false reboot stunt.

January 7, 2022

Cyclonis Backup

The Free Basic Cyclonis Backup plan gives you 2 GB of cloud storage space with full functionality! No credit card required. Need more storage space? Purchase a larger Cyclonis Backup plan today! To learn more about our policies and pricing, see Terms of Service, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.

Cyclonis Password Manager

FREE Trial: 30-Day One-Time Offer! No credit card required for Free Trial. Full functionality for the length of the Free Trial. (Full functionality after Free Trial requires subscription purchase.) To learn more about our policies and pricing, see EULA, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.