What Happened: A Permanent Chip-Level Vulnerability

Researchers publicly released a working exploit targeting the SecureROM inside Apple's A12 and A13 chips, as reported by The Hacker News. This is not a bug that a software update can fix because the flaw lives in the hardware itself, baked into the silicon during manufacturing. The exploit, which requires physical access to the device and a special USB cable, can take control of the device in less than two seconds.

This matters because it breaks the fundamental trust users place in Apple's security chain. Once an attacker gains that level of control, they can boot unsigned software and bypass Apple's normal protections. The devices affected include the iPhone XS, iPhone 11 series, and several iPad and Apple Watch models still commonly used in Australian businesses today.

The Real Risk: Physical Access Changes Everything

The key detail often missed in the headlines is that this attack requires someone to physically hold your device and connect it to a custom hardware tool. For most people, that is a low-probability scenario. But for businesses that manage fleets of devices, the calculus is different. An employee leaves their work iPhone on a desk during a break, and a bad actor with the right knowledge and equipment could compromise it permanently.

The exploit is now public, meaning it has moved from a researcher's lab into the open internet. While no active attacks have been reported yet, the code is available for anyone to study and adapt. This shifts the problem from "theoretical risk" to "practical preparation." Australian businesses that rely on older Apple hardware for sensitive tasks, such as handling customer data or managing payments, need to take notice.

What This Means for Australian SMBs

Many small and mid-sized Australian businesses still use iPhone XR or iPad models from the 2019-2020 era because they are reliable and cost-effective. Those devices now carry a hardware vulnerability that cannot be fixed by installing the latest iOS update. Your usual patching strategy will not protect you here.

The threat is physical, not remote. So the risk is highest for devices that are left unattended, shared among staff, or used in public-facing roles like retail counters, delivery vehicles, or field service. If a device is stolen or borrowed by someone with malicious intent, the data on it could be exposed. This is a reminder that device custody is just as important as software hygiene.

What You Can Do Now

  • Inventory your Apple devices. Check which models your business uses. If any run A12 or A13 chips (iPhone XS, XR, 11 series, iPad 8th gen, and others), flag them for review. Apple's support site can help you identify chip models by device name.
  • Plan a hardware refresh for sensitive roles. Devices used for accessing customer data, financial systems, or business email should be upgraded to A14 or newer models where this exploit does not work. Budget for this replacement over the next 12-18 months.
  • Enforce strict physical security policies. Never leave an affected device unattended in a public space. Use locking cabinets or secure storage for shared devices. Limit which staff can put devices into DFU mode.
  • Train your team on USB risks. Warn employees not to connect their work devices to unknown computers or charging stations, especially at trade shows, cafes, or co-working spaces. A malicious USB cable can look innocent.
  • Monitor for unusual boot behavior. If a device starts up differently, shows unexpected text during startup, or connects to strange USB accessories, treat it as a potential compromise and isolate it from your network immediately.

MS&VG helps Australian SMBs navigate these tricky hardware security decisions with practical, plain-language guidance. We can audit your device fleet and recommend next steps that fit your budget and risk level.