Apple's new "inactivity reboot" in iOS 18.1 frustrates law enforcement's access to iPhones

[Shawn Knight]

Editor's take: A security feature introduced in the latest version of Apple's mobile operating system is reportedly causing headaches for law enforcement officials. It's a controversial issue among some, but one that Apple likely isn't going to compromise on.

404 Media reported last week that some iPhones in the possession of law enforcement were mysteriously rebooting, making it more difficult for forensic experts to break into them and extract data as part of investigations.

It wasn't exactly clear why or how this was happening at the time, but now we have a better understanding of what is going on.

A security researcher from Hasso Plattner Institute in Germany has seemingly cracked the case. According to Jiska Classen and others, Apple added a feature known as "inactivity reboot" to iOS 18.1 that reboots a device if it is inactive for a certain period of time.

Apple indeed added a feature called "inactivity reboot" in iOS 18.1. This is implemented in keybagd and the AppleSEPKeyStore kernel extension. It seems to have nothing to do with phone/wireless network state. Keystore is used when unlocking the device.https://t.co/ONZuU9zVt2 https://t.co/4ORUqR6P6N pic.twitter.com/O3jijuqpN0

– Jiska (@naehrdine) November 8, 2024

Details are still emerging but the leading theory is that Apple's new feature reboots a device after four days of inactivity. Apple no doubt justifies the feature as an added layer of security, making iOS devices even less desirable for thieves that aim to resell devices or collect private data from them.

With less than a week to crack a stolen device before it reboots, thieves could decide to pass up iPhones in favor of Android handsets that don't such a restriction in place.

If that makes it harder for law enforcement to do their job, well… so be it. As we've seen in the past, Apple has little interest in going out of its way to break into its own devices to assist with police investigations.

As for the new feature, four days of inactivity feels adequate to trigger the feature. It's long enough that it isn't going to continually turn itself on by accident to the point that it becomes a nuisance, yet short enough to potentially have a meaningful impact against theft. And if the feature is triggered, all the owner needs to do is unlock the phone per usual using their passcode.

Permalink to story:

Apple's new "inactivity reboot" in iOS 18.1 frustrates law enforcement's access to iPhones

 

[J95qRP7]

With less than a week to crack a stolen device before it reboots, thieves could *device* to pass up iPhones in favor of Android handsets that don't such a restriction in place.

I think this was meant to be a different word?

 

[jonny888]

"...the leading theory is..."
"Apple no doubt justifies the feature as an added layer of security..."

So it's speculation with no direct confirmation of intent? Not sure I'd want to put words in Apple's mouth before they've said anything. You could end up being right of course, but it seems a little gun-jump-y. Personally I'd stick to the facts.

 

[seeprime]

"...the leading theory is..."
"Apple no doubt justifies the feature as an added layer of security..."

So it's speculation with no direct confirmation of intent? Not sure I'd want to put words in Apple's mouth before they've said anything. You could end up being right of course, but it seems a little gun-jump-y. Personally I'd stick to the facts.

Asking for a quote from Apple might help also.

 

[opckieran]

I think this was meant to be a different word?

“Decide”

 

[airbornex]

Soon we’ll be seeing ‘iPhones keep secrets’ in ad campaigns.

 

[BuckarooBonzaii]

What a simple solution. No phone usage for 4 days (timer), shut down automatically. Next feature will be to remotely shut down the phone.

 

[kiwigraeme]

Should be a basic feature of modems/routers to stop memory only infections, suppose the hacker will then keep it active, but that makes it spottable on the web, if main purpose was to lay low waiting orders

 

[Rudyduu]

"making iOS devices even less desirable for thieves that aim to resell devices or collect private data from them"

You think a thieve won't shoulder surf someone who has to punch in their code and then steal that phone once they get the code. Also, you think a thief cares if they sell a locked phone to someone, else? It's free money for them. Once they have the phone it's gone. It's not like they look at the phone that carefully before they steal it anyway.

 

[WhoCaresAnymore]

I think it's a great. You should restart mobile phones at least once a week. AT LEAST.

 

[sreams]

I think it's a great. You should restart mobile phones at least once a week. AT LEAST.

These phones won't restart unless they are not used. So this new feature won't promote weekly restarts at all.

 

[B5S46M]

I'm not familiar with workings of iPhones under the hood, so can someone explain why rebooting makes it harder to brute force?

 

[kiwigraeme]

I'm not familiar with workings of iPhones under the hood, so can someone explain why rebooting makes it harder to brute force?

I won't buy a an iPhone ever, my guest is relates to all computer devices that go into rest states with more info in memory and a higher state, easier to bring out.
So a reboot means a full check to come out of, maybe to a higher std
Plus in the resting state a device , PC, iPhone may be leaking additional info , maybe more communication tools active eg NFC, BT
Measuring micro voltages etc may mean only need 3 days on a device to brute force vs 30 days.
Think iPhones are quite protected vs brute force anyway

Imagine iPhone went to sleep hooked up to wireless apple earbuds , then maybe mimicking such earbuds can help access

IDK specifics , but mainly higher rest state on more info to be gain and broader attack zone

 

[QuaZulu]

“Decide”

"Response incorrect. Your access to TechSpot is now restricted, and your account will be deleted within four (4) days unless you input the correct response. Have a nice day!"