Mastodawn

Rahul Rachuri Nov 8, 2024

Apple added a feature called "inactivity reboot" in iOS 18.1. This is implemented in keybagd and the AppleSEPKeyStore kernel extension. It seems to have nothing to do with phone/wireless network state. Keystore is used when unlocking the device. So if you don't unlock your iPhone for a while... it will reboot!

In the news: "Police Freak Out at iPhones Mysteriously Rebooting Themselves, Locking Cops Out"
https://www.404media.co/police-freak-out-at-iphones-mysteriously-rebooting-themselves-locking-cops-out/

iOS version diffs to see yourself:
https://github.com/search?q=repo%3Ablacktop%2Fipsw-diffs%20inactivity_reboot&type=code

Police Freak Out at iPhones Mysteriously Rebooting Themselves, Locking Cops Out

Law enforcement believe the activity, which makes it harder to then unlock the phones, may be due to a potential update in iOS 18 which tells nearby iPhones to reboot if they have not been in contact with a cellular network for some time, according to a document obtained by 404 Media.

404 Media

There's a new article with more details on when the new inactivity reboot is triggered on iOS 18:
https://www.404media.co/apple-quietly-introduced-iphone-reboot-code-which-is-locking-out-cops/

This is a cheap & great mitigation! While most people won't have their phone forensically analyzed, many more will have their devices stolen. It protects user data in both cases.

Apple Quietly Introduced iPhone Reboot Code Which is Locking Out Cops

On Thursday 404 Media reported that police were freaking out about mysteriously rebooting iPhones. Now multiple experts have found that Apple introduced code that reboots locked phones after a period of time.

404 Media

Hope I can give you more details on inactivity reboot in ~4 days 🤞

darix Nov 10, 2024

@jiska if one of my phones is any indication. It will reboot

Pavel Machek Nov 10, 2024

@jiska Will the battery last four days? :-).

PaUwUle Nov 11, 2024

@jiska lol that’s one way to find things out

luap "kein Müsli" 42 Nov 11, 2024

@jiska Are we sure this works? maybe the iPhone is really shy and only reboots if it knows for sure it is not being watched?

lydia! was at eh23 Nov 11, 2024

@luap42 this reminds me of an idea that tom scott talked about in a park bench episode once - a watched pot that never boils. Hook up a face detection system to a hot plate to make sure the pot never boils as long as someone is watching it.

@jiska any updates so far? Unconfirmed rumors said its 72 hrs - I'd like to confirm the actual time 😊

👾Nov 9, 2024

Latte macchiato

ablobcat_longlong

@jiska Ooooh, that's big.

sophie Nov 8, 2024

@jiska hmm I saw another article dismissing the 404 media one, citing an iPhone reboot bug in iOS 18.0 fixed in ios 18.1 …
https://appleinsider.com/articles/24/11/07/iphones-stored-for-forensic-analysis-unexpectedly-reboot-causing-problems-for-officials
Based on these I suspect that it already got implemented in ios 18, though with a bug (random reboots) that was fixed in ios 18.1
Edit: it might also be something unrelated…

iPhones stored for forensic analysis unexpectedly reboot, causing problems for officials

Multiple iPhone units stored for forensic analysis have rebooted themselves, causing concern among law enforcement officials that Apple has a new security feature.

AppleInsider

@soph yeah I think the earlier reboots are unrelated...

Jorin Nov 8, 2024

@jiska yoooo based Apple says acab

mjdxp Nov 8, 2024

@jiska too bad for every good thing apple does, it feels like they do 20 bad things

Morgan Hill Nov 8, 2024

@jiska one wonders whether this is an intentional security feature or just a workaround for some hard to fix bug.

@pcwizz GrapheneOS does the same, so I think it's intended.

https://grapheneos.social/@GrapheneOS/112204443465440601

GrapheneOS (@[email protected])

Our auto-reboot feature starts a timer after the device is locked which will reboot the device is it isn't unlocked successfully before the timer elapses. This is set to 18 hours by default but can be set between 10 minutes and 72 hours. It won't chain reboot the device anymore.

GrapheneOS Mastodon

Maddy, Friendly Local Cryptid Nov 8, 2024

@jiska Hell yeah! This is not only great for security, but for the general user who rarely/never intentionally shuts down or reboots their phone. Helps prevent resource usage creep (which I don't often experience on iOS anyway)

Rick Baumhauer Nov 8, 2024

@jiska @cstross Is this also in iPadOS? I have mine on a stand next to my Mac’s monitor (which it is also connected to via a USB hub), but it is my least-used device, and it mysteriously rebooted itself last night.

neocat_flag_trans

@rick_baumhauer for all intensive purposes iPadOS is a different branch of iOS and as this is not a platform-specific feature to my knowledge I very much expect this to exist on iPadOS too

I may check the IPSW diffs of an iPad and reply later if I find the time, but in no way should you consider me an expert on this

Rick Baumhauer Nov 8, 2024

@cyrus Thanks! It’s my assumption that it is part of iPadOS, but since this was the first I’d heard of this “inactivity reboot”, I wanted to get confirmation (within reason - I don’t expect anyone to spend their day digging through this) before I chalked up my mystery reboot last night to it. It does make sense, though - I’m sure I hadn’t done much with my iPad in a few days.

neocat_flag_trans

@rick_baumhauer fwiw, this functionality is new, iOS (seemingly?) could force you to put in your PIN before but that is less powerful than never having entered it after a reboot - as at that point the key to data on the device has not yet been entered by the user and as such cannot be extracted from anywhere on the device

Andy Ibanez Nov 9, 2024

@rick_baumhauer @jiska @cstross Every so often, iOS/iPadOS devices might encounter a kernel panic and restart themselves. You find info in Settings > Privacy & Security > Analytics & Improvements > Analytics Data. Search for the word “Panic”.

Rick Baumhauer Nov 9, 2024

@andy @jiska @cstross No instances of “Panic” found there, but thanks for pointing that out - I had no idea that those logs were easily viewable on iPad.

| 🅥 |Nov 8, 2024

NosirrahSec 🏴‍☠️ guillotine enthusiast Nov 8, 2024

@jiska Locking pigs out is a happy side effect that is good for everyone.

Mike LaBonte Nov 8, 2024

@jiska at least police have effectively confirmed for us that they keep seized phones powered up in a Faraday cage

Jesper Lund Nov 8, 2024

@mikelabonte Not really new. Faraday bags are part of the Cellebrite toolkit https://cellebrite.com/en/from-murdaugh-to-josephson-how-south-carolina-law-enforcement-division-is-taking-on-big-cases-with-digital-intelligence/ @jiska

heart_nonbinary

@jiska
@GrapheneOS

GrapheneOS Nov 9, 2024

@lynatic @jiska Thanks, posted about it here: https://grapheneos.social/@GrapheneOS/113450097776800819. Will add a few more posts in a moment about our more recent work in this area.

We think the story about the rebooting phones with theories about them communicating with each other based on not having cellular was complete nonsense. It's not logical and does not sound like anything Apple would have implemented. It would be insecure and easy to bypass. After all, law enforcement can set up properly signed cellular networks.

GrapheneOS (@[email protected])

iOS 18.1 added an implementation of the auto-reboot timer for locked devices we've been using in GrapheneOS since June 2021: https://chaos.social/@jiska/113447894119816217 This was one of our early generation protections against forensic data extraction. We added a lot more protections this year.

GrapheneOS Mastodon

GrapheneOS Nov 9, 2024

@lynatic @jiska

Some actually likely scenarios:

1) the phones triggered a memory leak, integer overflow, etc. after being powered on for a very long time unable to connect to cellular, particularly since they'd be repeatedly trying to reconnect
2) the police didn't keep all the phones properly charged and came up with an excuse where Apple did it

The idea that they detected lack of cellular and communicated with each other via Bluetooth, UWB, etc. is such a fantastical theory with no proof.

Sergi Nov 8, 2024

@jiska interesting. My Android just got a new update with this similar feature:

"Offline Device Lock automatically locks your screen if a thief tries to keep your phone disconnected from the Internet for an extended period of time."

It's not a reboot, but also inactivity triggered.

Jon [🇺🇦,🏳️‍🌈]Nov 8, 2024

@jiska I wasnt going to upgrade to this version because of the AI, but this feature has chnged my mind.

⭐️Nov 8, 2024

@jiska thats fucking awesome

Farshid Hakimy / فرشید Nov 8, 2024

@jiska that's amazing!
I wish Google would copy these Graphene OS features into AOSP too.

Binks Nov 8, 2024

@jiska any evidence of the weirdest claim from that 404 Media article - that updated phones are instructing other iPhones to reboot?

Chris Johnson Nov 8, 2024

@Binks @jiska That bit seemed like nonsense to me.

neocat_flag_trans

okay I and some others assumed this was just the phone crashing or rebooting in trying to regain network but the fact that this is ACTUALLY intentional is great

Do you know how long this "while" is?

gudenau Nov 8, 2024

@jiska It would be fun if you could make it reboot when it doesn't see familiar Wi-Fi/Bluetooth devices that are associated with the user somehow.

@jiska I wish I was still employed at that company that makes forensic software, I'd love for them to see my reaction to that information. (It is joy. Malicious joy.)

Claire Elaina :bi_verify::trans_verify:Nov 8, 2024

@jiska omg, auto reboot? poggers!

but like, i didn't expect it to tell nearby phones... what if it could be used for a DoS?

Daniel Lyons Nov 8, 2024

@jiska "Apple may have introduced a new security feature in iOS 18 that tells nearby iPhones to reboot if they have been disconnected from a cellular network for some time."

Nearby? Are they saying that one iPhone can tell another iPhone to reboot?

@dandylyons I didn't find any traces of that, either it doesn't exist and the phones from the article rebooted because of something else, or it's yet another feature.

spacer Nov 8, 2024

@jiska Apple Calls Are Based

ScreechingBagel Nov 8, 2024

@jiska @GrapheneOS had this for a lil bit now :p love to see it

@jiska I am surprised Apple didn’t mention this at all.

| 💙➡️🇺🇦Nov 9, 2024

@jiska ah, they need to filibuster activity now.

Laird Brian Turbo of Sandwich Nov 9, 2024

@jiska Simple feature that will protect stolen/seized/lost phones. Love it.

hayalci Nov 10, 2024

@jiska i don’t have deep knowledge about hus aspects of security; why is it harder to crack if device reboots? Isn’t it the same protection as screen lock?

Geoffrey Fairchild Nov 11, 2024

@jiska I might've overlooked it, but how long is "a while"? Do we know yet how long the phone waits before rebooting?

Uckermark MacGyver

@jiska this is great research on this new security feature of iOS 18 🙏. The mysterious reboots are apparently an intentional security feature and not a bug.