Shank
8 days ago
The idea that iPhones magically communicate with each other to “reboot randomly” when off a cellular network (assumably would happen on a plane easily) is pretty far fetched. The far more likely explanation is that iOS 18.0 has some radio/modem bugs that causes devices to randomly reboot, likely correlated with long periods of disuse or lack of network connectivity.
Or heck, if the phone thinks the cellular modem isn’t working (like the phone in a faraday cage), some watchdog might just timeout and reboot.
In any case, the idea that they’re randomly networking and intentionally rebooting to thwart this specific law enforcement attack seems pretty unlikely.
sherry-sherry
8 days ago
I don't think it's what's happening here, but iPhones absolutely communicate with each other when there's no cellular network.
The 'Find My' network uses all iPhones/iPads/Macs (unless disabled) to locate said devices and other items over Bluetooth LE.
> The Find My network is an encrypted, anonymous network of hundreds of millions of Apple devices that can help find your stuff, even when it’s offline. Nearby devices securely send the location of your missing device to iCloud, so you can find it in Find My. It’s all anonymous and encrypted to protect everyone’s privacy. — https://support.apple.com/en-au/104978
MBCook
8 days ago
But that’s just Bluetooth beacon stuff, it’s one way broadcast communication to anything that’s listening.
It’s like an automated ARP response packet that’s automatically transmitted occasionally without needing to hear a request.
jlarocco
7 days ago
Sure, but iOS has to listen for them and do... something... when they see a "Find my iPhone" beacon.
TBH I think it's very unlikely, but it's entirely possible they could add a flag to those beacon messages suggesting other iOS devices reboot.
On the other hand, I can easily see it being an honest bug where being off a cellular network corrupts the beacon message somehow, and reading the corrupt messages triggers iOS to reboot.
Who knows
wobfan
7 days ago
I don’t get why they’re suggesting that iPhone communicate to each other to reboot. I mean, what do the iPhone gain? Both have the system time and know for how long they have had no mobile network. They don’t have to set up complicated communication for that. What does the other device know more than the iPhone that makes it know that it has to restart?
bbarnett
7 days ago
By some means, its location?
"HEY Bob, you're in the pokey, reboot so your filesystem is umounted!"
A network deprived phone might not realize, yet a friendly nearby may.
I doubt this is so, but it would be a fun game.
therein
6 days ago
Why could it not be something like Find My iPhone lock/reboot request is an encrypted packet that is destined to arrive at iPhone with Serial Number XYZ. Another iPhone gets near the target iPhone and shares its presence with Apple. Apple has been waiting to deliver this encrypted signed packet from Find My iPhone network to the target device. This packet is sent to the iPhone in range and then the data is delivered over AWDL.
rfoo
5 days ago
This breaks the anonymous nature of Find My network. There might be a way to mitigate it but I'm sure that's not a can of worm you would want to open.
zxcvbnm69
7 days ago
[dead]
therein
6 days ago
It is potentially more than just one-way Bluetooth beacon stuff. Apple tried to unify many ways Apple devices could communicate with each other over AWDL.
user
7 days ago
mistrial9
7 days ago
do you have evidence that it is only a beacon signal between Apple devices post v18 ?
kubectl_h
8 days ago
What's interesting to me is that Apple's stance of not unlocking iPhones for law enforcement has led to this paranoia on law enforcements part. Honestly? Good.
MBCook
8 days ago
Apple doesn’t have a stance of not unlocking phones for law enforcement. They give law enforcement whatever they’re asked for by subpoena.
Apple‘s stance is to build strong encryption so that they can’t access customers data. What they have refused to do is weaken that encryption so that they could start complying with future requests or sign tampered with firmware that would allow the decryption without user authorization.
voxic11
7 days ago
Apple does have this stance. They have been subpoenaed before to assist in unlocking older iPhones that don't have as strong protection of user data as modern iPhones and they refused those orders as well.
Basically older iPhones without the modern secure enclave enforced the password attempt lockout period in software so the FBI obtained a court order to force apple to create and sign a new version of iOS that would not enforce the lockout period, which would allow the FBI to guess the password. Apple refused to create this new version of iOS and the FBI eventually retracted their request.
Modern iPhones enforce the lockout period in the secure enclave hardware so this is no longer something Apple could even possibly assist with.
https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d...
tssva
6 days ago
The case you reference did not involve a subpoena but an order under the All Writs Act. Annorder which compelled certain behaviour unless the order was appealed within a specified time. Apple appealed the order within that time period and thus was in full compliance with the order. The government withdrew the case before the courts could rule whether the order was legal. I assume Apple would have complied with it if it was ruled so. What we do know from this case is that Apple did attempt to assist the FBI with accessing the phone even without a court compelling them to do so.
EMIRELADERO
7 days ago
> Modern iPhones enforce the lockout period in the secure enclave hardware so this is no longer something Apple could even possibly assist with.
You mean in the sillicon itself? If it's done in the Secure Enclave's firmware then Apple could assist with unlocking.
MBCook
7 days ago
That’s what I meant by this:
> …sign tampered with firmware that would allow the decryption without user authorization.
Apple wrote the firmware for everything. I assume they could write firmware to not need authorization, embedded in a copy of iOS, and sign everything so it could be installed on a phone through DFU.
They have been unwilling to do so. I think they’re right not to. But I suspect it is technically possible.
tmottabr
7 days ago
But if court ordered then to do so they would have to..
In the previous case law enforcement retracted the request because they found an alternative..
If the alternative stop working i bet you they will go after Apple in courts again..
wobfan
7 days ago
There have been multiple credible sources with internal documents claiming that iPhone with the current firmware (>17) can’t be hacked currently. It’s in constant flux, obviously, but iOS is very advanced on this aspect. Android phones on the other hand, apart from the Pixels >6, are all hackable with appropriate tooling.
tmottabr
4 days ago
As far as i remember there is a single leaked document about a specific celebrite version that had iOS 17 marked as already supported for some devices up to version 17.0.3, versions 17.1 to 17.3.1 as coming soon and 17.4 as in research..
And that document is from last April, 7 months ago, no one really knows how things progressed after that..
Best assumption to make is that all those versions are supported by now..
support for iOS 18 could be available or not, we do not know.. So again i will assume it is supported until the opposite is proved..
But all the latest iPhones in latest iOS versions were only supported in AFU, that apple is handling with this reset feature, or IPR, that require USB being unlocked and is extremely time sensitive as there are already defenses in place..
fsflover
6 days ago
> multiple credible sources with internal documents claiming that iPhone with the current firmware (>17) can’t be hacked currently
You can't prove a negative.
adastra22
7 days ago
The whole point of a Secure Enclave is that you can’t perform such an update without wiping the data.
HHad3
7 days ago
You can update SEP firmware, but only by providing your PIN. This is why iOS prompts for you PIN again before updating.
This still effectively prevents Apple from adding backdoor to be installed on phones the user can no longer access.
adastra22
6 days ago
Depends on the enclave. I don't know Apple's, but the ones I worked with would wipe secure data on a firmware update.
kbolino
7 days ago
I would think that the secure enclave controls the device (un-)locking process and also wouldn't install OTA firmware updates nor accept commands from USB-connected peripherals while the device is locked.
altairprime
7 days ago
Settings > Passcode > Allow access when locked: [_] Accessories.
Off by default, providing a one hour timeout since last phone unlock; or instantly, upon biometric rejection or after holding power-volume-up to reach the power off menu.
Macs are typically enabling an equivalent to this by default as well now, as of the latest macOS update.
skygazer
8 days ago
They also refused to make a build (signed by Apple) which would remove any of those protections, though technically possible, but would have tainted their products as backdoored. They were prepared to argue forcing them to do that would be the government compelling speech, a violation of the First Amendment, a precedent the FBI didn’t want, and so turned to a CellBright type service instead. Apple did make public statements at the time against backdooring devices which might be construed as a stance.
briffle
7 days ago
> Apple‘s stance is to build strong encryption so that they can’t access customers data.
In the US and EU, where it is politically easy. https://support.apple.com/en-us/111754
mlindner
7 days ago
More correctly: In states where individual rights are protected.
TowerTall
8 days ago
As far as I know the iCloud backup are unencrypted so law enforcement can just request a backup of those instead.
philistine
8 days ago
You're not up-to-date and your language is not exact:
1. Your backups are encrypted in transit and at rest. You have a key, Apple also has one.
2. You can optionally ask Apple to get rid of its key to your backup. (https://support.apple.com/en-us/108756)
fsflover
6 days ago
In other words, the parent is correct: by default it's not encrypted against Apple (no e2ee).
kaba0
6 days ago
It's encrypted, period. Apple having the key doesn't make it plain text.
fsflover
6 days ago
It depends on your threat model. Against Apple (forced to give the info) it is effectively plain text.
philistine
4 days ago
That's why we use the term end-to-end encrypted.
user
4 days ago
fsflover
4 days ago
Yes, which is exactly what I wrote in brackets. Still got downvoted.
kubectl_h
7 days ago
> Apple doesn’t have a stance of not unlocking phones for law enforcement.
Yes and they have also made it such that they can't bypass all that by providing a mechanism to unlock the phone. Hence they don't unlock the phone.
user
8 days ago
_fat_santa
7 days ago
My conspiracy theory here is that Apple knows that this is how law enforcement goes about unlocking phones with tech like Cellbrite so they add in code to thwart that effort but keep quiet so they can have the plausible deniability of it just being a bug.
WorldMaker
7 days ago
Easier to assume it's a theft ring deterrent, eliminating some of the routes to social engineering that theft rings have been using, further reducing the usefulness of collecting large numbers of stolen iPhones in the same central place.
nxobject
7 days ago
It's good if the countermeasures against the two things are indistinguishable.
tcmart14
7 days ago
Yea, it seems like this would be easily verified, if true, by security experts. Watch the network traffic in a faraday cage. See some strange packets that don't make sense with currently used protocols, okay, maybe there is some truth. But if all you see are packets that arn't surprising (in this case, a ping to try to find a cell tower) and a reboot occurs, then there is no mystery, its probably as you suggest a bug or trying to self health from a failed watchdog check.
Its all happening over RF, its not like they can implement this so a signal opens a inter-dimensional portal and comes back out making it undetectable on the RF spectrum.
CryptoBanker
7 days ago
One of the devices was stored in a Faraday cage in airplane mode[1] - there's literally nothing to monitor
[1]https://appleinsider.com/articles/24/11/07/iphones-stored-fo...
vlovich123
7 days ago
> The affected devices even included one that was in Airplane Mode and another that was kept in a Faraday cage
> The officials hypothesize that an iPhone running iOS 18 can send signals that make nearby units reboot if the device has been kept disconnected from cellular networks.
Either the officials are storing multiple devices in 1 cage, don't understand Faraday cages, or are arguing in bad faith.
> In October of 2024, multiple users of iPhone 16 Pro and iPhone 16 Pro Max units reported that their devices kept restarting themselves for no apparent reason. This is a known issue that occurred during normal use and one that Apple fixed with the iOS 18.1 update.
> This timeframe would also align with the creation of the alleged law enforcement document. Specifically, the document says that three iPhones with iOS 18.0 were brought into a forensics lab on October 3, after which they rebooted themselves.
Ah ignorance or bad faith after all.
NikkiA
7 days ago
Faraday cages don't stop audio and we know [1] there are google/android devices that use ultrasound to communicate with other google/android devices.
It's not ENTIRELY far fetched, but it is very unlikely.
[1] https://www.wired.com/story/ultrasonic-signals-wild-west-of-...
tcmart14
7 days ago
I agree it is very unlikely. And I don't think you are proposing this is the case, but for the sake of argument. However, wouldn't it still be rather easy to verify? Faraday cage just helps with isolation and filters out the noise, so you can analyze a smaller set of data, in this case meaning you have to parse through less signals/data. But you would still be able to pinpoint this. If you can just monitor ultrasound, filter out what isn't easily explained/common (like background background radiation is to the universe).
To verify the original claim that it could happen over BLE, you don't need a faraday case to verify or prove this. The faraday cage just allows you to cut down on the data/signals to analyze.
chasil
7 days ago
Such a feature added intentionally would also impede theft rings, which might be the true intent.
tmottabr
7 days ago
Why not both??
Two birds, one stone..
beeflet
7 days ago
>The idea that iPhones magically communicate with each other to “reboot randomly”
well they do silently communicate for the "find my" network. I don't see why that couldnt result in a reboot somehow
talldayo
7 days ago
> I don't see why that couldnt result in a reboot somehow
Because Find My is a reverse-engineered protocol that can be abused to broadcast false information to nearby devices? Trusting Find My to know when it's time for a reboot sounds like an amazing Flipper Zero feature but a not-so-great experience for iPhone owners.
beeflet
6 days ago
sorry about necroing this, but I was implying that the reboot would be a result of unintentional behavior (a bug) in some local p2p code.
The find my network is just an example of local p2p functionality that is largely opaque to users.
LorenPechtel
8 days ago
Second this. It strikes me as a completely reasonable watchdog. Other than if you're keeping it around in a faraday cage it's very unlikely to receive *nothing* for an extended period. How many people take phones into such environments for extended periods? Thus if nothing is coming in it probably means something's messed up.
And if it reboots on the cops Apple probably considers that a plus.
elzbardico
7 days ago
They do communicate with each other for the "Find My" feature to work even when disconnected from cellular and wifi. It is basically the same operating principle behind Apple Tags.
wmf
7 days ago
I agree that it's unlikely but consider that Apple stores have a "dock" that can power on an iPhone and do an iOS upgrade while it's sealed in the box. Who knows what P2P communication protocols iPhones have.
cududa
7 days ago
Only the latest iPhones (15 and 16) support this
Loudergood
7 days ago
Does that work on a configured, encrypted iPhone?
theshrike79
5 days ago
Info from the future: it seems that fresh iOS18 versions reboot the phone if they haven't been unlocked for a specified amount of time (days it seems).
If it's in the hands of a legit owner, they just need to type the iCloud password and they're back in. If it was stolen or confiscated, it just became a very expensive brick unless they can coerce the owner to log in somehow.
0points
6 days ago
> The idea that iPhones magically communicate with each other to “reboot randomly” when off a cellular network (assumably would happen on a plane easily) is pretty far fetched.
iOS devices communicate thru a separate ultra-wideband mesh network used for "Find My" and more recently the AirTags.
melq
8 days ago
iPhones are already communicating with any and every bluetooth capable Apple device to enable the findmy/airtag functionality aren't they? I dont believe this is necessarily true just that its theoretically possible.
Jtsummers
8 days ago
The issue is not that Apple devices communicate with each other. It's the absurd claim that there's a secret handshake between Apple devices that tells them to reboot if they've been offline and locked for too long.
So sit around in a less secure state for weeks and months and only when externally triggered reboot? That's a stupid feature and makes no sense. If you were to base any partial security measure off of how long a device has been powered up and locked, then just use a timer. Why wait for another phone to wander by?
Though the digital forensics lab claims they were all in airplane mode with one inside a faraday box, so how are they communicating with each other? This suggests incompetence on their part, perhaps not actually putting them in airplane mode or not understanding that bluetooth/wifi can be enabled (and may enable themselves) separately from the cellular radio.
NemoNobody
7 days ago
It's not a network feature - the auto restart of the phone, it's not doing so bc of handshake signal, but rather the lack of one. This is incredibly similar "tech/apple innovation" that is very similar to timed DRM media services.
If you download all your songs from Napster - they will work for a month or two without connecting to a network but eventually the lack of a connection will lock the content, it doesn't kno if your still paying, so it makes you sign in.
This is the same but all behind the scenes. Apple phones are constantly communicating with their network or other devices - if that stops, something fishy is going on bc it's not supposed to be able to.
The restart is prolly more for them - that's probably the solution to most of the issues with a phone losing network connection, just restart it. So they built it in.
Sure it does what phones have done forever and makes you sign in with password or full biometrics once at startup buts that's not new either.
MBCook
8 days ago
It’s communication in that information is being passed, but it’s a one-way Bluetooth broadcast. It’s not any kind of two-way communication.
At most an iPhone may be able to broadcast a Bluetooth message saying “anybody out there?“. I don’t even know if that’s possible. I’m sure Apple‘s white paper has the answer but I don’t remember it.
porbelm
5 days ago
[dead]
xk_id
8 days ago
It’s very well established by numerous studies that apple products continuously scan for other wireless devices in their proximity, especially Apple ones but including wifi routers, and then upload their hardware IDs and MAC addresses to apple server, together with GPS location.
reaperducer
8 days ago
And what does that have to do with the article?
xk_id
8 days ago
Parent wrote (emphasis mine):
> the idea that they’re randomly networking and intentionally rebooting to thwart this specific law enforcement attack seems pretty unlikely.
So there is partial evidence for it at least.
Someone
7 days ago
> So there is partial evidence for it at least.
Where? If you want that to be partial evidence, you have to parse that sentence as:
(they’re randomly networking and intentionally rebooting) to thwart this specific law enforcement attack
which means
(they’re randomly networking to thwart this specific law enforcement attack) AND (they’re intentionally rebooting to thwart this specific law enforcement attack)
All you show is that they’re randomly networking, not that it’s for thwarting even any law enforcement attacks, so I don’t think what you say is partial evidence.
NemoNobody
7 days ago
Well you could use the information that you just accepted is collected to identify which phones are in custody by the police, which phones have been stolen, lost or left without a user - that's all very easy actually considering the apple network and the number of their devices.
Having a few lines of code to dictate what happens once a phone has been identified as any of the above is pretty simple stuff.
I think this restart is for Apple - an easy attempt to restore the devices network connection (and the data stream from it) and has little or nothing to do with law enforcement originally but now Apple will say that's the whole entire reason this exists bc privacy.
Anyways, it was absolutely relevant info to the article and considering it and more - it's obvious that Apple could have done this, or something like it, to thwart cops but is very unlikely.
user
7 days ago
xk_id
7 days ago
It’s still more evidence than if we knew they don’t network AT ALL. Partial means inconclusive, but more than definitive proof to the contrary.