Newly Discovered iPhone Attack Vector Can Be Used to Spy on Victims

Security researchers working with ZecOps have discovered a new proof of concept attach vector that ultimately allows potential threat actors to spy on you using your iPhone's camera and microphone.

The new attack is named 'NoReboot' and was researched and discovered by a security team, as a proof of concept, which means it was not spotted in the wild, being used by hackers.

Quiet Persistence

The attack uses a method to achieve persistence on the targeted device by faking a device reboot and can thus keep malicious processes and activity active, while to the user, it seems that the device has been rebooted as normal.

NoReboot makes it look like your iPhone is rebooting as normal. However, the shutdown is fake and it leaves the microphone and camera on the phone exposed for hijacking. NoReboot injects malicious code into several background process daemons on the iPhone, namely backboardd, InCallService and SpringBoard.

The audio-visual elements that are included in an iPhone's reboot process such as the animated spin can all be hijacked using the injected malicious code. According to the security researchers who developed the proof of concept attack, a fake reboot triggered by NoReboot is visually indistinguishable from a real one. However, in the fake one, the device remains connected to the service provider.

The attack includes methods to also trigger a false reboot before a real forced restart is triggered, which makes it even more dangerous.

Not Very Easy to Fix

The attack could be effectively used by potential threat actors to achieve persistence while simultaneously tricking the user into thinking their device has been rebooted. According to ZecOps, the issue will be hard to fix with a simple patch, due to the fact that it relies on tricking the user into thinking something has happened normally, while it really hasn't - the entire purpose of the false reboot stunt.