Cellebrite Reveals LOKI: Zero-Day Boot ROM Exploit for Apple Devices

• •Cellebrite's LOKI exploit targets Apple boot ROMs from iPod touch 2 to iPhone 11.
• •The exploit requires physical access and operates in DFU mode via USB.
• •Early proofs of concept show a low success rate of 1 in 25 attempts.

Cellebrite has unveiled a zero-day exploit named LOKI at the Hexacon conference, targeting the boot ROM of Apple chips from the iPod touch 2 to the iPhone 11. This exploit, which requires physical access to the device via USB in DFU mode, takes advantage of a timing race condition, with early proof-of-concept builds achieving a success rate of only 1 in 25 attempts. The boot ROM is immutable and cannot be patched through software updates, making this a significant vulnerability. The exploit leverages a DMA bug in the Synopsys DesignWare USB controller, potentially affecting a decade's worth of Apple SoCs from A5 to A13. The session was presented by Steven De Franco, a known researcher from Cellebrite. The implications of this exploit are serious for users of older Apple devices, as it allows for data extraction before any operating system defenses are activated.