back to article iOS 18 added secret and smart security feature that reboots iThings after three days

Apple's latest mobile operating system, iOS 18, appears to have added an undocumented security feature that reboots devices if they’re not used for 72 hours. This has implications for anyone trying to maintain access to a stolen or lawfully seized iOS device without a valid passcode. When an iPhone reboots, it enters a state …

  1. SomeRandom1
    Trollface

    Microsoft - Ahead with security!

    Windows has been secured like this for years and more - instead of 3 days, they reboot after 3 hours!

    1. Anonymous Coward
      Anonymous Coward

      Re: Microsoft - Ahead with security!

      "Windows has been secured like this for years and more - instead of 3 days, they reboot after 3 hours!"

      Yeah, this was actually the reason why win95 was rebooting after, I think 17 days of inactivity: security !

      1. Aremmes

        Re: Microsoft - Ahead with security!

        “Windows 95 stores the time since boot as milliseconds, in an unsigned 32-bit integer. After 49.7 days, that number overflows to 0, and the machine hangs.”

        https://thenewstack.io/a-fan-of-vintage-computing-counts-down-to-a-windows-95-bug/

        1. mantavani

          Re: Microsoft - Ahead with security!

          That reminds me of working for Maplin electronics the day the in-house EPOS rolled back around to transaction number -2147483648.

        2. Andrew Scott Bronze badge

          Re: Microsoft - Ahead with security!

          linux has a similar problem. reboot when the timer wrapped around. this was in the 32 bit days. though linux on a dec alpha was immune from the issue I think. at the time i think the response from Linus was get a 64 bit machine.

          1. William Towle
            Linux

            Re: Microsoft - Ahead with security!

            > linux has a similar problem [...] in the 32 bit days. though linux on a dec alpha was immune from the issue

            You may have been downvoted for "has" there. While linux had a similar problem due to the jiffy counter being "unsigned long" -which did indeed mean 32 bits on i386 for kernel 2.4- that's a long time ago now.

            AFAICT the worst case scenario for a minimal system was seeing unusual uptime reports, although anything in userland/drivers that relied on consistent behaviour from the same clock would have got upset in various ways. I gather design changes (including this, 2003) went into kernel 2.5 and thought important enough to get backported.

            (I'm interested in historical kernels at this time but hoping I don't have to build anything quite that old...)

  2. DS999 Silver badge

    Anything that makes life harder for companies like Cellebrite

    Is a good thing.

    Yeah yeah people will say "what about terrorists" but for every legitimate terrorist whose phone the cops want to break into there are probably 10,000 phones of people innocent of crimes they are suspected of or are only guilty of entering the US while having a Muslim name.

    I just wish the interval was configurable. 72 hours still gives them too much time as far as I'm concerned. You should be able to configure 12 hours and 1 hour instead of 72 if you want. If I had those options I'd set it for 12 hours because if I go 12 straight hours without ever once unlocking my phone then I'm not going to care if it reboots. And I'd set it to 1 hour anytime I was crossing a border - heck in that case I'd want a 1 hour reboot timer regardless of activity so if they grabbed it out of my hands while it was unlocked they couldn't do much with it!

    1. storner
      Stop

      Re: Anything that makes life harder for companies like Cellebrite

      "I'd set it to 1 hour anytime I was crossing a border"

      In that case, you should either turn it off completely before crossing the border, or use a burner phone instead of your own.

      1. DS999 Silver badge

        Re: Anything that makes life harder for companies like Cellebrite

        Supposedly in at least some cases customs agents make you turn the phone on and even unlock it to prove it is a real phone and not a bomb I guess. So you'd want the reboot as a backstop even if your phone was powered down when you stood yourself in line.

    2. Anonymous Coward Silver badge
      Black Helicopters

      Re: Anything that makes life harder for companies like Cellebrite

      > "if they grabbed it out of my hands while it was unlocked"

      Then they have full access regardless and won't let it reach this timeout.

      1. Jimmy2Cows Silver badge
        Holmes

        Re: Anything that makes life harder for companies like Cellebrite

        Which was exactly the "regardless of activity" point.

    3. CowHorseFrog Silver badge

      Re: Anything that makes life harder for companies like Cellebrite

      Strange how you think the government is your enemy but you fail to see the real people and companies that are really ruining your life and stealing far more of your data.

      1. deadlockvictim

        Re: Anything that makes life harder for companies like Cellebrite

        Have you paid no attention to Ronald Reagan? The Markets know best and government is not a solution to our problem, government is the problem.

        He made poor Americans poorer and rich Americans richer.

        1. CowHorseFrog Silver badge

          Re: Anything that makes life harder for companies like Cellebrite

          WHy would an Australian pay attention to Reaganomix ?

      2. doublelayer Silver badge

        Re: Anything that makes life harder for companies like Cellebrite

        You are aware that multiple groups can abuse your privacy at the same time? Sometimes, they even team up to collect the information that they have the easiest access to and exchange it for money or more information. If you, like I, don't like the abuses of privacy, you generally have to know about and try to work against all of the abusers simultaneously.

        1. CowHorseFrog Silver badge

          Re: Anything that makes life harder for companies like Cellebrite

          you must be clever for stating the obvious.

          Do you want to also tell me the sky is blue ?

          1. doublelayer Silver badge

            Re: Anything that makes life harder for companies like Cellebrite

            Judging from your response to people with completely understandable concerns about law enforcement abuse of private data, concerns you chose to dismiss in favor of orthogonal ones, it seemed like you might be unaware. Were you to make a similar comment about sky colors, for example "Strange how you think the sky is something other than gray and refuse to see clouds", I might similarly inform you of the blue option. I assume you are unaware of, rather than willfully ignoring, obvious things which would make your comment unnecessary.

            1. CowHorseFrog Silver badge

              Re: Anything that makes life harder for companies like Cellebrite

              double: Judging from your response to people with completely understandable concerns about law enforcement abuse of private data, concerns you chose to dismiss in favor of orthogonal ones, it seemed like you might be unaware.

              cow:

              I am very much aware that there arae bad police around the world, but im my country (Australia) basically nobody is worried about the police.

              The world is a place full of many different types of people, and organisations. In my country basically nobody has any fear of the police doing anything wrong against them. Nobody is worried about the police shooting them ( i think the Australian police shoots maybe 2 people in a bad year) and all that.

              When people think bad of the police, they make everything much worse, because the police generally make my country and many others a better place. By being so any law enforcement, you are actively preventing the police from catching the bad guys. THose bad guys are making your country far worse than the police.

              Use your brains, help the police catch the bad guys.

              Im not anti governmebt, because today as an adult i contribute back to my country by paying taxes and im trying to do my bit just like my country gave me roads, schools and hospitals and all that other good stuff.

              Morons like you who are anti goverment forget the greater good that the gov ernment has done, without the government, you would nt have schools, roads, water, electricity, basically you would be living in a place with shit flowing outside your home and bandits around every corner, and you want to tell me government is bad. This is extremely short sighted.

  3. Mentat74
    Coat

    "smart security feature"...

    It was probably just a bug...

    And when it was finally discovered they thought : "You know what ? Let's keep it in there and call it a 'feature'..."

  4. Pascal Monett Silver badge
    Thumb Up

    "law enforcement is under more time pressure"

    I'm all for it.

    I've had more than enough of hearing how the police run amok through people's private data whether they have a case or not.

    If you can't get a warrant, you shouldn't be looking at my data.

    1. DS999 Silver badge

      Re: "law enforcement is under more time pressure"

      Well just for the sake of correctness, this also prevents lawful police access via court order. Or makes it much harder. If the target has advanced data protection enabled for iCloud in their iPhone's security settings, or don't use iCloud at all, then Apple can't provide anything in response to a subpoena either.

      But I'm fine with that. The police managed to crack cases for decades before suspects carried the equivalent of a tracking device, camera, paper map, notepad, appointment book, medical records, and a nearly complete log of all "mail" conversations and many "talking" conversations and on and on with them wherever they go.

    2. CowHorseFrog Silver badge

      Re: "law enforcement is under more time pressure"

      Yes those evil police, trying to arrest bad people.

      Im sure your country would be far better without any police, fire stations and ambos... oh sorry i forgot hospitals are socialist scum so you have already eliminated 2 out of 3 fine government services and the fine people who help the community by being a part of those three.

  5. Anonymous Coward
    Anonymous Coward

    In a building where all meeting rooms use one iPad to link to the room booking system to "login" to a meeting and another to control the zoom screen on the room ... then this will be 'interesting" on the Tuesday after a bank holiday weekend!

    1. Lazlo Woodbine Silver badge

      I was just thinking that, we use iPads for staff to sign in and out of buildings for fire registers, so after a Bank holiday IT are going to be busy dashing around the site signing into all the iPads...

      1. yetanotheraoc Silver badge

        Mouse-move

        You need the equivalent of a cron job on the device that undertakes some activity once every 24 hours and resets the timer. Is there an App for that?

        1. JessicaRabbit

          Re: Mouse-move

          It seems to be time since last unlock not just activity otherwise this wouldn't be any kind of barrier to thieves/law enforcement.

        2. katrinab Silver badge
          Gimp

          Re: Mouse-move

          A shortcut to do the activity, and an automation to run it every 24 hours.

          I have one that sets my alarm clock based ultimately on what is in my calendar.

          But I’m not sure that would count for this purpose.

      2. doublelayer Silver badge

        How are those iPads locked? If someone accidentally pressed the screen lock button, do they need to call IT to fix it? If so, then yes, this could be a problem. If these aren't secured with a passcode, though, then it wouldn't affect you. They would just have to unlock it normally after the weekend.

    2. Irongut Silver badge

      Similarly as an app developer i'm wondering how much of a pain in the ass this is going to be when all my test devices reboot because I had a few days off.

    3. GlenP Silver badge

      Hopefully they've at least disabled this when Guided Access is set.

    4. Tom66

      You can set an iPad to a kind of "Kiosk Mode" where it will automatically log in. They likely already do this as iPads will need to update from time to time which requires a reboot.

  6. heyrick Silver badge

    They're spinning it as a security feature?

    Instead of an "it can't be left alone for more than three days"...?

  7. This post has been deleted by its author

    1. CowHorseFrog Silver badge

      No this is a case of a non feature being promoted for no particularly reason when it basically adds no value of any kind.

      A bit like apple and how wonderful some new laptop or phone is because its 0.01mm thinner, when nobody asked or cared.

    2. Al fazed
      WTF?

      I can imagine,

      that many of my friends who prefer iDevices but who are not IT savvy will be confused when their iPhone, iPad, Bluetooth speakers etc, all need a pass code entering before reuse, because these people generally speaking didn't make a note of the pass code they entered first time they used the device.

      Help ! I know several who won't even let me change their keyboard to UK....

      Or have it explained why you don't simply yank the plug from the wall when you have finished doing their Universal Credit Journal entry. This is usually required once a week, or maybe fortnight, when they get their latest sick note from their GP. It is generally speaking the only time they use their iPad, as everything else gets done on their iPhone.

      More embuggeration of those least able to be unbuggered ?

      ALF

      1. katrinab Silver badge
        Meh

        Re: I can imagine,

        You need your passcode often enough that this is really not going to be an issue.

  8. Blackjack Silver badge
    Trollface

    Meanwhile some Android phones explode if you leave them too long charging.

  9. mevets

    Find My Phone.

    Is the killer app that keeps me engaged.

    I *need* find my phone because it is inevitably discharged wherever I last used it.

    Does this enhancement mean that next time I lose my phone it is gone forever?

    I really hope this use case is being considered; otherwise I will stop buying a phone every 8 years.

  10. This post has been deleted by its author

    1. Test Man

      Re: So all you have to do to bypass is use the phone once a day?

      No, you have to UNLOCK it before 3 days has elapsed.

      So the feature is useful.

  11. Anonymous Coward
    Anonymous Coward

    Some Things Never Change......

    Quote: "...Security Enclave Processor (SEP) ..."

    In my day (a while ago, when management consulting was a thing) SEP meant "Someone Else's Problem".

    Plus ca change.....

    1. KayJ

      Re: Some Things Never Change......

      Silly sausage, it's an upgrade package for the Abrams tank...

      *is immediately squashed by a flying restaurant*

  12. neilhd

    Rather than reboot

    Couldn't it just remove the encryption keys from memory and alter itself back to the BFU state, requiring a "first" login again? It could do that every couple of hours without affecting much, no?

  13. Anonymous Coward
    Anonymous Coward

    Love iphone updates

    It always disables security settings (turns on features to leak data)

    Always puts new Annoyance features in, pop up when you are trying to do normal stuff, saves things you delete. Like MS they make it so its painful/time consuming to use.

    Looking forward to being dead so I don't have to deal with this crap.

  14. sev.monster Silver badge

    GrapheneOS, a security-hardened Andoid fork, has had this for years. Some other flavors also ship with it. Nice that Apple is pushing it to all their new kit at least, I wish Google/et al. would do the same.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like