USBLiter8: The New iPhone BootROM Exploit
If you’ve been around the iPhone hacking community for a while, you’ve probably heard of checkm8, the BootROM exploit that changed everything for older iPhones. Now, years later, researchers have released a new exploit called USBLiter8, and it’s a pretty big deal.
But what exactly is it, and why is everyone talking about it?
Let’s break it down.
What is USBLiter8?
USBLiter8 is a hardware exploit that works against Apple’s A12 and A13 processors. These chips are found in devices like:
- iPhone XS
- iPhone XS Max
- iPhone XR
- iPhone 11
- iPhone 11 Pro
- iPhone 11 Pro Max
- Some Apple Watch models with S4 and S5 chips
Unlike a normal software bug, this vulnerability exists inside the phone’s BootROM.
Think of the BootROM as the phone’s built-in startup program. It’s the very first thing that runs when the device powers on, even before iOS starts loading.
Because it’s permanently built into the chip at the factory, Apple cannot fix it with an iOS update. Once the chip leaves the factory, the BootROM never changes.
Does this mean anyone can hack my phone?
No.
This exploit is not remote. Someone cannot attack your phone over Wi-Fi or the Internet.
To use USBLiter8, an attacker needs:
- Physical possession of the phone
- The phone placed into DFU (Device Firmware Update) mode
- Special hardware connected over USB
- Custom software to trigger the exploit
So while it’s a powerful research tool, it isn’t something the average iPhone owner needs to panic about.
How does the exploit work?
Imagine a mailbox that is only supposed to accept envelopes of one exact size.
Instead of following the rules, the researchers discovered that if they fed the mailbox envelopes that were too small in a very specific order, the mailbox would start putting mail in the wrong place.
That’s basically what happens here.
The bug exists in the USB hardware built into the chip. By sending specially crafted USB packets, the exploit tricks the hardware into writing data where it shouldn’t.
Once that happens, the researchers can eventually gain control before iOS even starts loading.
Why is BootROM so important?
Everything starts from the BootROM.
Normally the startup process looks something like this:
- BootROM starts
- BootROM verifies iBoot
- iBoot verifies iOS
- iOS loads
Every step checks the next one to make sure Apple signed it. USBLiter8 interrupts that process before the security checks are finished. That allows researchers to run their own code instead of only Apple’s signed software.
Does this jailbreak the phone?
Not by itself.
This is something many people misunderstand. USBLiter8 gives researchers control very early in the boot process, but that’s only the beginning. To build a complete jailbreak, developers still need to:
- Bypass additional iOS protections
- Patch the kernel
- Build jailbreak tools
- Create a user-friendly installer
Think of USBLiter8 as giving someone the keys to the building. They still have to unlock each room inside.
Why can’t a normal USB cable do this?
One of the most interesting parts of this research is that a normal computer cannot send the malformed USB packets needed to trigger the bug. Instead, the researchers use a small programmable microcontroller that gives them complete control over the USB signals.
This lets them create USB traffic that a normal USB controller simply won’t generate.
Hardware people are using
At the moment, the public proof-of-concept primarily uses:
- Raspberry Pi Pico 2 (RP2350)
- Waveshare RP2350 USB-A board
- Other RP2350-based development boards
- Some RP2040 boards (less reliable)
These tiny boards cost only a few dollars and can be programmed to send the exact USB packets required for the exploit.
Are there packaged tools yet?
Right now, not really.
The public release from Paradigm Shift is mainly a proof-of-concept intended for security researchers.
At the time of writing:
- There is an official GitHub repository containing the source code.
- There are community tutorials explaining how to build and use it.
- Some forensic companies have already started adapting the exploit into their professional tools.
- There is not a polished, one-click jailbreak like the checkra1n releases many people remember.
Are there any videos?
Yes, although the number is still fairly small because the exploit is new.
Most videos currently show:
- Entering PWN DFU mode
- Programming a Raspberry Pi Pico
- Demonstrating the exploit running
- Explaining how the vulnerability works
As the community spends more time with USBLiter8, expect many more tutorials and tools to appear.
Final Thoughts
USBLiter8 is probably the biggest BootROM discovery since checkm8 was released in 2019.
For security researchers, it’s an exciting breakthrough because it opens the door to studying devices that were previously much harder to access.
For everyday users, the risk is relatively low because the attack requires physical access, DFU mode, and specialized hardware.
Still, it reminds us that even hardware thought to be permanently secure can contain hidden flaws that aren’t discovered until years later. That’s exactly why security research like this is so valuable—it helps everyone better understand how modern devices really work.