Bricked iPhone 16 Can Be Restored Wirelessly Using Another iPhone

https://www.macrumors.com/2024/09/18/iphone-16-restored-wirelessly-another-iphone/

by impish9208 • 2 years ago

113 119 2 years ago

mdaniel5• 2 years ago

If that can be done "off grid," then I welcome it because it's likely a jailbreak vector

avianlyric• 2 years ago

Not a chance. iOS installs are cryptographically bound to the hardware itself installed on. It’s not possible to get an iPhone to boot an iOS install without an Apple server providing that cryptographic binding.

0l• 2 years ago

Assuming it's implemented properly, that is. The whole reason Jailbreaks exist is due to bugs in Apple's implementations.

mdaniel5• 2 years ago

Well, one will observe that I said "off grid," because I was acutely aware of the desire for them to approve OS reinstalls

I know, "but muh sekurity" and all that, but when the grandkids find an antique iPhone 16 in a barn somewhere, and want to install an iOS image upon it to see how things were in the old-times, I want that to be technically possible even after Apple shuts down the old gatekeeping servers

explaininjs5• 2 years ago

Curious what you want from a jailbreak at this point? It seems all of the old things that were actually helpful have found them into first party software, or at least in the sanctioned third party. (internet tethering, emulators, side loaded apps, etc.)

fragmede5• 2 years ago

Internet tethering is actually one that's gone backwards, with "unlimited" cellphone plans that are limited when tethering. Or plans that disable tethering even though all the software is there.

The other thing from a jailbreak would be for it to become self hosting, that is, give the ability to make full blown iPhone ipa on an iOS device without needing a macOS device anywhere at all.

mdaniel5• 2 years ago

I thank goodness I haven't been subjected to (mobile) Apple for many years in order to speak to what they "allow" and don't nowadays, but the short answer is that I want to *fucking own* the hardware I pay fuckloads of money to purchase

Also, while I was typing out the "I want f-droid.org for iOS" I realized there is a pragmatic answer: I want to build and distribute apps without having to pay for the right to do so, not because I am stingy but because paying is gatekeeping. Do you know how much the Joplin devs have to pay Google to put this .apk link here[1]? $0

1: https://joplinapp.org/help/install/#mobile-applications

RulerOf2• 2 years ago

I have a fairly simple list:

- a weekly, scheduled reboot of the device

- an iMessage addon that can auto-respond with `stop` to every political spam message I get

- an iMessage addon that would let me filter, categorize, and display messages in a manner I choose instead of a Big Dumb List, like we've had for email for decades

- an iMessage addon for services like Beeper

- an iMessage addon that ... I smell a pattern

ElFitz• 2 years ago

And just like the original PSP’s batteries, you would be able to jailbreak an iPhone simply using a jailbroken iPhone.

Brajeshwar• 2 years ago

Will this not increase the economic value of stealing iPhones?

Right now, in India, iPhone sales compete with used iPhones. With an option to unbrick phones, what methods are preventing a new market of “Chor-Bazaar for iPhones” (market for stolen iPhones)?

kylehotchkiss• 2 years ago

I am so happy to see a chor bazaar reference here. I got one of my antique SLR cameras from there!

toymin• 2 years ago

Pretty sure this doesn't remove Activation Lock so it shouldn't make a difference

brigade• 2 years ago

Bricked as in doesn’t boot the OS, not bricked as in unable to be activated.

Brian_K_White• 2 years ago

Then it's not a brick.

Why is the term "bricked" in the first place?

Because of the utterly dead properties of a brick. The whole point was a visceral image of just how not remotely recoverable under any circumstances, vs merely a little extra effort can recover.

An unformatted empty computer with no os is not a brick in the same way a cd player with no cd inserted is not a brick. It's still fully functional.

olliej4• 2 years ago

No, this is not adding a new version of resetting a device, it's just providing a mode where if your phone is bricked you don't need to find a computer and cable to get back to a working state if you're with someone else who has an iPhone.

The thing the limits the resale/theft value of an iPhone is activation lock - not the ability to reset the device. Resetting or restoring an iPhone does not remove activation lock, and this does not change that.

cdchn4• 2 years ago

India have a lot of carriers that don't care about stolen IMEIs?

lofaszvanitt• 2 years ago

w o w

what could go wrong

olliej4• 2 years ago

I'm not sure? what is the threat you're concerned about here?

My reading of this is that it's just removed the requirement to use a wired connection to a laptop to restore a phone that is already in DFU/restore mode - I'm not sure what attack/flaw you get from allowing the recovery path over wifi that would not already be an option with the existing wired path?

MBCook6• 2 years ago

Well, IF you have an exploit capable of bypassing all iPhone security you could now use it by setting something on someone’s phone for a few minutes instead of plugging into it.

Is that useful? Maybe. No fingerprints?

Of course you still need that billion dollar exploit first.

SheinhardtWigCo• 2 years ago

This is presumably in preparation for removing USB-C next year?

teruakohatu• 2 years ago

The latest AirPods have usb-c, with the higher tier also including wireless charging. If there was ever a device category to remove usb-c it would be AirPods (which would still be a terrible idea)

derefr2• 2 years ago

I would argue the opposite: AirPods are a pure "client" device — they need to be connected to by something, they don't connect to something; and they have no display, input method, or other means to initiate/change Bluetooth pairing, if the state of the firmware somehow gets in a mucked-up state and they need to be flashed. The only possible way to recover broken AirPods is via tethered recovery.

An iPhone is the opposite: both a "client" and a "host", with plenty of options (in theory) for interactively initiating and configuring a wireless recovery boot. Almost capable enough (again, in theory) to be used for standalone debugging of its own hardware faults (like you'd do with a PC using a live USB image.) For 99% of faults, an iPhone should be capable of non-tethered recovery — if Apple would just write the firmware so as to enable that.

And the other 1% of the time, you've probably got at least one failed critical hardware component preventing early boot. At which point "flashing the OS" would be the least of your concern; and instead, you'd just take the thing into the Genius Bar, and they'd open it up, and then either tap into an interior debugging interface (as presumably they'll leave the lightning debug pins exposed as something like JTAG pads); or they'd temporarily swap the mainboard out into an "everything but the mainboard" recovery harness, flash it there, and then stick it back into the phone. At which point they could then use the recovered base firmware's recovery mode to QC the rest of the hardware!

ShadowRegent• 2 years ago

I'm not so sure. One of the potential benefits of removing ports from the iPhone is improved water resistance (personally, I'd still rather have the port). I don't foresee going swimming with my AirPods case.

cdchn4• 2 years ago

I think a big part of the reason (maybe the only reason?) they went to USB-C is because they were legally compelled to by European regulations, not sure if they can then about-face on that just by removing the port.

Jtsummers2• 2 years ago

think a big part of the reason (maybe the only reason?) they went to USB-C is because they were legally compelled to by European regulations

It wasn't the only reason, it was inevitable even without the regulations. They'd already switched their laptops to USB-C in 2015 (?), and the iPad in 2018. The phones and some accessories (keyboards, mice, charging cases for AirPods and such) were the last remaining Lightning devices. All the regulations did, if anything, was set a deadline that was probably internal no more than one or two years past when they made the switch.

astrange3• 2 years ago

The regulation doesn't require having a port I believe. Just that if there is a port, it's USBC.

dwaite8• 2 years ago

The problem is that other than faster charging, the vast majority of people would not see USB-C as an upgrade, and instead a play to make them buy new cables and chargers. Even though Apple had switched over to exclusively bundling USB-C to lightning cables with the iPhone 11 (2019) and usb-c to MagSafe for Apple Watch Series 7 (2021), a USB-C port on the device does not in itself provide a clear advantage for migration - Apple switching could just be seen as a play to get everyone to buy new cables and chargers.

Even after the switch to USB-C, it blows my relatives' minds when I explained you could plug a USB flash drive into the phone directly. It is just a charging hole for most.

My hypothesis is that they were already planning to go to USB-C on the pro models last year an then trickle it down to the base model 1-2 years following - the SoC was updated with USB 3 features like 10 Gbps data transfer and DP alt mode, and they had software features like capturing 4k video directly to a connected external SSD. The base 15 was left on an older SoC due to cost/yields at TSMC.

Europe may have moved them to upgrade the base model 1-2 years earlier. However, by doing such a migration "begrudgingly" Apple got to use Europe as a little bit of a scapegoat in the press. The forced migration is the answer to the upset questions about the migrating generating a lot of e-waste in terms of obsolete cable and accessories, and in the consumer cost of upgrading a decade of old chargers and lightning cables around their homes, vehicles, offices, etc.

GeekyBear2• 2 years ago

Needing to connect an iDevice that wouldn't boot to a PC or Mac in order to restore a factory OS image wasn't exactly a high bar to get over, but this does give you another option for recovery.

devilbunny3• 2 years ago

It isn’t for most people here. But the most valuable tool for fixing a broken computer is a working one, and a lot of people don’t have more than one anymore. Some don’t even have that.

My wife texted me on Friday as she was visiting her mother six hours’ drive away. She needed her laptop. They do not own a desktop, and her dad was at our house on a business trip with his laptop in tow.

Do not underestimate the utility of just outfitting houses that you/spouse spend a fair amount of time at with at least functional computers and such. I put MoCA and three access points in their house as a Christmas gift. It cost me $500 and about two hours of work, but I have never gotten another call about bad WiFi. I bought an AppleTV for their house just to have a Tailscale endpoint. I think they will eventually end up actually using it as an AppleTV, but until then, it’s my door into their network (and another private VPN service for me).

My 2008-era spare laptop isn’t snappy, and it’s not in good shape. But it boots Windows and Linux, and in the absence of anything else it can at least SSH and web-browse, write a USB drive, etc.

Aloha• 2 years ago

You would be amazed how many normal people dont have a computer - they have an iPad and an iPhone (or android similars), and yeah - its like that now.

whartung2• 2 years ago

I bought an AppleTV for their house just to have a Tailscale endpoint.

How the heck does that work?

zimpenfish• 2 years ago

Do not underestimate the utility of just outfitting houses that you/spouse spend a fair amount of time at with at least functional computers and such.

Can confirm the utility - I buy a lot of stuff that lives at my parents house precisely for this kind of reason.

brianpan• 2 years ago

As a former hardware engineer, if it can be restored wirelessly or otherwise, it's not a brick yet. Keep trying, you'll get there! ;)

trash_cat• 2 years ago

semi-brick

DonHopkins• 2 years ago

Brick Different!

fragmede5• 2 years ago

Keep trying to de-dramaticize language, you'll get there!

Seriously though, the last time I truely bricked something was because I overwrote the bootloader on a chip that had no other way to flash, and it was an all-in-one, so I couldn't solder to the chip and reprogram it directly. Now that was a brick. A board that I can still solder to a chip and bus pirate my way to victory, isn't a brick. Being able to do so wirelessly? psh.

Edit: I'm remembering now, that hardware was an Apple keyboard. I wanted to flash the firmware so I could have capslock be left Ctrl in hardware, but I flashed the wrong thing and then could not flash an updated image to it.

freedomben• 2 years ago

I wanted to flash the firmware so I could have capslock be left Ctrl in hardware

You're a person after my own heart. If there is a God, you're doing his/her/their work.

What was the hardware and firmware you were flashing?

stepupmakeup• 2 years ago

I don't think I've ever truly "bricked" a iPhone, or got one to the point it CAN'T be put DFU mode and restored. Cydia tweaks made it sound like one wrong move could render your device permanently unusable, at most it was a inconvenience.

Retr0id2• 2 years ago

You can very easily brick an iPhone by logging in to an iCloud account and then forgetting the password (which of course TFA will not help with)

xandrius2• 2 years ago

Everything is a brick until you figure a way to fix it.

I thought I bricked my old phone but it turns out I just needed to open the phone, short a couple of pins 5-10 times and trying to quickly boot into flashboot, repeat if it didn't work.

It turns out I was a fool thinking that it was bricked after all.

dwaite8• 2 years ago

Sure, but shouldn't there be a minimum standard like "the built-in and well-documented recovery process failed?"

ChocolateGod• 2 years ago

Apple's latest devices apparently come equipped with a dedicated recovery partition

Didn't they always have this, minus the wireless functionality, isn't that the entire point of DFU/Recovery Mode?

mdaniel5• 2 years ago

Well, pedantically DFU allows injecting someone else's recovery partition, usually from a computer over USB but probably from Apple's CDN if they have the equivalent of macOS's "Internet Recovery." What I'm guessing this change provides is that the iPhone itself carries a recovery partition, and based on the language allows pseudo-AirDrop-ing it to someone else

alliao• 2 years ago

this is the sort of functionality that only appears when the pain in the retail is felt by the corp. though can't say I think it's a good idea though.. feels like a free rein for state level adversaries...

bpye• 2 years ago

Presumably the signing requirements are the same as the normal USB DFU process?

wmf2• 2 years ago

At smaller scale if a problem affects 1 out of 100,000 customers you just eat it. But at Apple's scale and profit margin they can afford to fix it.

MBCook6• 2 years ago

This may be an outgrowth that just sort of fell out of their project to allow updating the software on iPhones in the box.

they did that so people wouldn’t buy a new phone that had been sitting on the shelf for a few weeks or whatever and then immediately have to update the OS. By using a special device they designed they can power up and update the phone with the latest OS in the box so buyers are almost always up-to-date when it hits their hands.

But the fact that they did all that probably means that they had everything they needed to do this. Or maybe that’s how they “update” the phone, they don’t update the OS like a user would they just reflash it completely.

grishka2• 2 years ago

though can't say I think it's a good idea though.. feels like a free rein for state level adversaries...

All iOS devices have secure boot that (unfortunately) can't be disabled.

fragmede5• 2 years ago

Most ;)

1-6• 2 years ago

Imagine the ramifications of this. I’m not a technician for any secret agents but I can see how this will make black hat attendees very excited.

tsujamin• 2 years ago

Yeah that they are confident enough in their chain of trust to allow this says a lot I think

supportengineer• 2 years ago

Not bricked if it can be fixed.

irobeth• 2 years ago

Locked iPhone owned by law enforcement target will accept remote firmware push from trusted device?

olliej4• 2 years ago

It _sounds_ like this is just the standard restore path, only now it can be done wirelessly. Restore/DFU is an erase all content path - there are some cases where restore can avoid erasing the old data, but that path requires the device pin, and if you know the pin, then you definitionally don't need to jump through any hoops to unlock the device.

astrange3• 2 years ago

iOS restore doesn't trust anything; that's why you need an internet connection to do it. This proxies the internet connection.

https://support.apple.com/guide/security/secure-software-upd...

heraldgeezer• 2 years ago

ooh sounds very exploitable!

Would be interested in a deep dive.

How "bricked" is recovery mode? Kernel borked? Like PSP pandora battery?

zamadatix• 2 years ago

This looks to be about enabling the "bricked" (as in not recoverable without external tools, in this case) iPhone to receive the recovery image over wireless connection as an alternative to receiving it over a wire. All of the same protections around needing to be a signed image, a device not on Apples stolen/banned list, and needing to be done from an iPhone already asking for recovery (i.e. it's not some state you push wireless TO the device, it's something it requests and other devices can accept helping with) stay in place regardless if the data is received over a wire or now wirelessly. At most the exploitability change here would be in removing the requirement to have another device connected via cable to execute some set of attacks that break the actual security steps.

gnabgib• 2 years ago

Source article iPhone 16 firmware can now be restored wirelessly from another iPhone https://9to5mac.com/2024/09/17/iphone-16-firmware-restored-w...

spoonjim• 2 years ago

I've never heard of a "bricked" iPhone. I didn't think you could flash its firmware outside of official methods so how exactly would you brick it?

eqvinox• 2 years ago

You can always have something (e.g. overheat, battery failure, cosmic ray, …) go wrong during an "official method" and leave it in a bad state.

circularfoyers2• 2 years ago

I still don't understand why Apple haven't changed their update model to A/B partitions, so if an update can't boot, it boots the previous partition. Android has been doing this for a while and Fedora Silverblue/IoT does the same thing, both of which I've found really useful in the past. If communicated well, it would elviate the update anxiety many people I know have with their iPhones.

wmf2• 2 years ago

How much space should they reserve for iOS 24?

BonoboIO• 2 years ago

Sell the base 128GB model that will be too small pretty soon and sell the cloud storage. Win win.

yjftsjthsd-h2• 2 years ago

and Fedora Silverblue/IoT does the same thing,

Silverblue uses ostree, which AIUI uses hard links in a single filesystem. This is probably better most of the time, because it means minimal storage overhead, though it means you can't change filesystems over an update and you don't resist filesystem corruption.

MBCook6• 2 years ago

What percentage of iPhones actually require DFU after a bad iOS upgrade?

I’ve had iPhones since the 3GS and never experienced it, neither have anyone I’ve known.

I’m sure it happens, but I suspect it’s really rare.

dwaite8• 2 years ago

It will not be able to reliably work with the A partition once B boots the first time - the update process even for many minor releases will trigger local and cloud data upgrades, and there are security reasons to not leave the option to leave older/unpatched versions runnable.

I don't think I've had a software update fail since iOS 7 beta 1 - and that was an issue with updating local data on first boot, so any attempt to revert to the prior OS without a wipe would have been pointless.

circularfoyers2• 2 years ago

I believe the point isn't to let you rollback at will, but it'll automatically rollback if it fails a boot check, so before anything is written to the filesystem. However, it's worth noting that Fedora Silverblue/IoT let's you rollback at will without problem.

igornadj• 2 years ago

How often does a deployment rollback go smoothly? Almost never. The priority is roll-forward and reduced error scopes.

system2• 2 years ago

Funny nobody is asking why a flagship gets bricked in the first place. Also, the author probably doesn't understand the meaning of brick. Bricked means bricked. Dead beyond recovery without doing some extraordinary stuff.

FloatArtifact• 2 years ago

I get the feeling in the future Apple wants to kill the usb c port and lock down the iPhone a access with the proprietary wireless only protocol.

Bricked iPhone 16 Can Be Restored Wirelessly Using Another iPhone

Related Stories