usbliter8 Burns a Permanent Hole in A12 and A13 SecureROM

Researchers at Paradigm Shift have released a working exploit, dubbed usbliter8, that hits arbitrary code execution inside the SecureROM of Apple's A12 and A13 application processors. SecureROM is mask ROM. It is laid down at fab. No OTA, no firmware update, no MDM policy can touch it.

That is the part worth sitting with.

This is a tethered, USB-side exploit in the lineage of checkm8, not a remote one. An attacker needs the device in hand and in DFU mode. So the threat model is physical — lost phones, border stops, evidence rooms, supply-chain interdiction, the resale market. Pretty much the same calculus that has governed checkm8 since 2019, but now extended forward two chip generations.

Affected silicon covers the A12 (iPhone XS, XR, XS Max, iPad mini 5, iPad Air 3) and A13 (iPhone 11 series, iPhone SE 2nd gen, iPad 9). A lot of those handsets are still in active service as hand-me-downs, kiosks, MFA carriers and corporate-issued spares. Apple's own support windows still cover several of them with iOS 18.

Because the bug lives below the bootloader, it sits below the Secure Enclave Processor's trust anchor. The SEP itself is not directly broken by usbliter8 — user data protected by the device passcode and SEP-held keys remains encrypted at rest. What an attacker gains is a permanent ability to run unsigned code at boot, bypass image verification, sideload a custom ramdisk, and stage downstream attacks against the data protection stack with the device's owner none the wiser on next power-on.

For passcode brute force, the SEP's rate limiting still bites. But a SecureROM foothold is exactly the prerequisite forensic vendors have wanted for years. Expect to see it folded into commercial extraction tooling within months.

Would MFA have helped? Honestly, no — this is hardware root-of-trust, not authentication. But it does change how you should treat an A12/A13 device as a second factor. If the phone holding your passkeys or TOTP seeds goes missing and you cannot prove it stayed in your custody, rotate. WebAuthn credentials bound to the Secure Enclave are still bound. The threat is what runs around them at boot.

Practical guidance for IAM and IT teams:

• Treat lost or seized A12/A13 hardware as compromised at the boot layer, regardless of whether it was passcode-locked. Revoke any platform-bound credentials, rotate refresh tokens, and invalidate device-trust postures in Conditional Access or equivalent.
• For high-risk roles still carrying iPhone XS through SE2, plan a refresh to A14 or later, where SecureROM is not known to be exploitable.

No CVE has been assigned at time of writing; SecureROM bugs historically do not get one, since there is nothing to patch. Apple has not commented publicly. Paradigm Shift says a technical writeup with the USB stack details is forthcoming.

It is checkm8, two generations later. Same shape, longer shadow.