Cops freaked out about it.
On Thursday, 404 Media reported on an unusual phenomenon: iPhones that were locked for an indeterminate period of time were rebooting. This, quite naturally, caused police officials some degree of distress; for investigations, phones are often stored for quite some time. And when these phones rebooted during that time, well, it became much harder for the authorities to break into these devices.
It seems, however, that the reason for this is, in fact, not some third party, but rather, Apple. They silently added code into iOS 18.1 that reboots a locked device if it hasn’t been unlocked in some time.
According to a post from Christopher Vance of Magnet Forensics made to a law enforcement/forensic expert only group chat, the code essentially runs a timer for inactivity. Once the timer is up, it takes the phone from an AFU (After First Unlock) state to a BFU (Before First Unlock) state. Both states refer to the first unlock since being powered on. The problem, however, is that the BFU state i much harder for forensic tools to open. Notably, this timer is run by the device itself; it’s not tied to any network connection or charging functions.
According to Chris Wade, the founder of the mobile analysis company Corellium, speaking to 404 Media, the phone will reboot after four days of inactivity.
Apple, naturally, has refused to comment on the matter.
This is not the first time that Apple’s security features have earned the ire of law enforcement. But while the authorities are understandably upset, they’re not the real targets of these security updates. As Matthew Green, cryptographer and associate professor at Johns Hopkins University told 404 Media:
Remember that the real threat here is not police. It’s the kind of people who will steal your iPhone for malign purposes. This feature means that if your phone gets stolen, the thieves can’t nurse it along for months until they develop the tech to crack it.
Matthew Green
Green went on to note that while the feature doesn’t really inconvenience anyone, it does boost the overall security of the device.
Nonetheless, Magnet Forensics’ Vance urged members of that aforementioned group chat to to collect evidence from AFU iOS 18 devices post haste. As he puts it, “It is imperative that you collect the data from your AFU devices as soon as possible with iOS 18.”
Source: 404 Media
About Author
