Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by I_Am_Nous | Hacker News Reader

Full thread

I_Am_Nous·

>Although infections didn’t survive a reboot

Reminder to reboot your iPhone at least weekly if you are concerned about this kind of attack.

View on HN

In a week, a lot of data can be exfiltrated. Then after you have rebooted, the threat actor reinfects your device.

Frequently rebooting the device can’t hurt but it likely isn’t going to prevent a threat actor from achieving their objectives.

The best mitigation we have is to enable lockdown mode.

Why not both? Lockdown + frequent reboots.

How frequent?

Depends on usage and threat models? If one expects their device to be attacked immediately after a forced restart, SIM PIN can stop non-emergency usage of the cellular line, while Apple Configurator can restrict WiFi to a predefined SSID that captures device traffic for forensic analysis.

> reboot your iPhone at least weekly

with the Hard Reset key sequence, https://www.wikihow.com/Hard-Reset-an-iPhone

Sorry for the lay question but what’s the benefit of the hard reset over a general restart?

Layperson here so just guessing. If not using the hard reset method, the exploit might fake the reboot sequence to maintain its own persistence. AFAIK, a hard reset is built in hardware and thus impossible to fake.

I believe they’re assuming that malware can do a pretend reboot whereas the hardware keystroke can’t be faked.

No, they could monitor when devices rebooted and re-infect them immediately, as the article states.

Reply on news.ycombinator.com