American law enforcement officials have notified officials and criminologists that iPhones seized from detainees and stored in anticipation of hacking are somehow rebooting themselves, after which the devices enter a state in which they are much more difficult to unlock. This is stated in an official document compiled by law enforcement officers and which was obtained by the 404 Media portal.
Image Source: Nicholas Thomas/Unsplash
The exact reason why Apple smartphones reboot is unknown. The authors of the document, who are police officers in Detroit, Michigan, suggest that this is due to a new security feature implemented in iOS 18. We are talking about a feature that forces the iPhone to reboot if the device is not connected for some time. to the telecom operator’s network. Accordingly, after a reboot, unlocking the smartphone becomes much more difficult.
«The purpose of this notice is to draw attention to the situation with iPhones, where devices reboot after a short period of time (possibly within 24 hours) when they are disconnected from the cellular network,” the law enforcement document says. At the time of publication of material on this issue, Apple has not officially confirmed whether iOS 18 actually implements an automatic reboot function in the event of a prolonged absence of connection to a cellular network.
The law enforcement document states that several iPhones were stored in the forensic laboratory in the “After First Unlock” state. Some smartphones operated in airplane mode, and one of the iPhones was in a Faraday cage to protect against the possible destruction of information stored on the devices through a remote connection. AFU status means that after turning on the iPhone, someone (usually the owner of the device) has unlocked the smartphone at least once using a password or other means. As a rule, it is easier for police to hack a smartphone in AFU state using specialized tools. After rebooting, the device goes into the “Before First Unlock” state. In this state, it becomes much more difficult for forensic scientists to hack the device, the law enforcement document says.
The document mentions three iPhones with iOS 18 that were delivered to the laboratory on October 3. Law enforcement suggests that under certain conditions, iPhones with iOS 18 that were delivered to the laboratory interacted with iPhones already there that were in an AFU state. During this interaction, a signal was given to reboot if there was no connection to the operator’s network for a long time. It is also possible that such interaction could occur not only with iPhones delivered to the laboratory, but also with personal smartphones of employees.
The authors also made some recommendations to colleagues. Specifically, they advise isolating iPhones they store in AFU state to avoid interfering with other iPhones running iOS 18. They also recommend taking inventory of iPhones stored in labs to ensure they haven’t rebooted on their own.