Old iPhones Remain Vulnerable to Bootloader Exploits Despite Airplane Mode, OneKey Warns Crypto Users

Founder of hardware wallet maker OneKey Ishan Wang has cautioned that storing cryptocurrency seed phrases on reset older iPhones in airplane mode does not provide reliable protection. Physical access attacks leveraging persistent bootloader vulnerabilities such as checkm8 and usbliter8 can bypass standard iOS security even on devices without network connectivity. The checkm8 exploit affects iPhone models from 4S through X, while usbliter8 targets A12 and A13 chips found in iPhone XS, XR, 11 series and second-generation SE devices. These flaws allow attackers to break the secure boot chain and execute arbitrary code before the operating system loads, and factory resets do not mitigate them because the vulnerable bootloader code cannot be overwritten through normal updates. Although bootloader access alone does not decrypt wallet contents due to device passcode, Secure Enclave protections and application-level encryption, the overall risk depends on device model, iOS version, additional vulnerabilities and password strength. Wang advises against relying on legacy offline iPhones as cold storage and recommends generating a fresh seed phrase and transferring assets if exposure is suspected.

AntiMalwareNovember 2, 2026Translated from Russian

Read at source

Storing a cryptocurrency wallet recovery phrase on a wiped older iPhone placed in airplane mode does not guarantee safety, according to a warning issued by OneKey founder Ishan Wang.

The advisory focuses on physical-access attacks rather than remote theft. Two notable hardware-level vulnerabilities allow an attacker who obtains the device to compromise the boot process. The checkm8 exploit impacts iPhone generations from iPhone 4S to iPhone X. The more recent usbliter8 targets A12 and A13 chips, covering iPhone XS, iPhone XR, the entire iPhone 11 family and the second-generation iPhone SE.

Both flaws enable an attacker to break the trusted boot chain and run code before iOS starts. The usbliter8 attack requires specialized USB hardware. A standard factory reset does not eliminate the risk because the vulnerable bootloader code cannot be replaced by ordinary firmware updates.

Nevertheless, bootloader access by itself does not automatically decrypt wallet data. The device passcode, Secure Enclave processor and application-level encryption continue to serve as protective layers. Actual risk therefore varies according to the specific model, iOS version, presence of additional vulnerabilities and the strength of the passcode.

Wang recommends that users stop treating legacy offline iPhones as dependable cold-storage solutions. If a seed phrase may already have been exposed, simply creating a new address within the same wallet is insufficient; a completely new seed phrase must be generated and assets transferred to it.

Secure Enclave checkm8 usbliter8 OneKey

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulnerabilities & Exploits

Vulnerabilities & Exploits

AI Agent Uncovers Backdoors with Password 123456 and Hardcoded Keys in Encrypted USB Drives

An AI-powered analysis has exposed critical flaws in multiple USB encryption and copy-protection products, including hardcoded administrator accounts and keys independent of user passwords. The research focused on devices from SecZure, Netac, KakaSoft, and Nexcopy, where fixed credentials such as 123456 and SECZURE.COM allowed full file decryption without the legitimate administrator password. In several cases the encryption key was extracted directly from the binary or configuration files, rendering user passwords irrelevant. The AI agent replicated months of prior manual reverse engineering in minutes using static analysis and Binary Ninja MCP. Weaknesses included the use of fast MD5 and HMAC-MD5 derivations, ECB mode without IVs, and fixed 32-byte AES keys embedded in executables. The findings highlight systemic problems in closed-source cryptographic products marketed for data protection and copy prevention.

HabrNov 2, 2026Translated from Russian

Vulnerabilities & Exploits

Security Week 2645: Critical UEFI Flaw CVE-2026-97631 Enables Remote Code Execution During Network Boot

Researchers from Google and Anthropic disclosed a serious vulnerability in most UEFI implementations that has existed for 16 years. CVE-2026-97631 affects the network boot driver and allows memory corruption when specially crafted ICMP error messages are received during PXE boot. The flaw resides in TianoCore EDK II code used by major vendors including AMI, Insyde, and Phoenix. Exploitation grants arbitrary code execution with maximum privileges before the operating system loads, but only when the system boots over the network. Additional stories from the past week include the Binance exchange breach, a critical Brotli vulnerability, supply-chain compromises affecting Ledger and Trezor hardware wallets, and multiple other high-severity issues across Android, TeamViewer, and browser extensions.

HabrNov 2, 2026Translated from Russian

Vulnerabilities & Exploits

Why UFW Fails Against Docker: Anatomy of Network Bypass and Bot Exploitation of Exposed Database Ports

A common Docker Compose setup with PostgreSQL and Redis using default port mappings like 5432:5432 and 6379:6379 bypasses UFW firewall rules due to Docker's manipulation of Netfilter chains. Docker inserts DNAT rules in the PREROUTING chain and places DOCKER-FORWARD rules ahead of UFW's deny policies in the FORWARD chain, allowing external traffic to reach containers even when ufw status shows default deny incoming and routed. The issue affects both IPv4 and IPv6, with docker-proxy binding to [::] addresses and ip6tables rules enabling similar bypasses in Docker 27+. Bots scan cloud IP ranges within minutes of deployment, targeting open database ports and deploying miners such as kinsing or kdevtmpfsi via Redis commands like REPLICAOF or CONFIG SET for cron persistence. Historical cases include a Hetzner CPX21 instance compromised in under two minutes and Spree Commerce starter issues where unprotected Redis led to immediate infections. Mitigation requires careful use of DOCKER-USER chains, disabling IPv6 where unnecessary, or switching to nftables for unified filtering.

HabrNov 2, 2026Translated from Russian