The latest iPhones can be hacked by any high school student with a $70 Raspberry Pi. Video

Due to the peculiarities of iOS and the Bluetooth protocol, iPhone smartphones can be hacked using a cheap device based on the Raspberry Pi, which even a person with no action in electronics can assemble. Such a gadget sends fake notifications asking you to enter your Apple ID password, which at the same time looks like the real ones. Many users can enter their password without seeing the fake, that is, they themselves can transfer it to the hacker. The range of these devices is 10-15 meters.

Hack iPhone “for a penny”

Modern smartphones Apple iPhone, which forbidden V Russian ministries and state companies because of the threat of surveillance by USA, it turned out to be possible to hack using a single-board computer from the Raspberry Pi family. As the portal writes TechCrunchon the basis of this PC, you can assemble an inexpensive device that bypasses the protection of the device using a very simple, but effective method – it literally forces the owner of the gadget to enter a password for it, but arranges all this they user does it at his own will

The simplest device in its design costs, taking into account all its components, about $ 70 or about 6550 rubles. in the rate CB at the time of publication of the material. It will not be difficult to assemble it even for those who are not particularly friendly with electronics, and it is able to hack any iPhone that is password protected in a radius of 10-15 meters.

The presentation of the device took place at the world’s biggest annual conference for hackers, security experts and developers Def Con 2023, and every visitor who owns an iPhone became an involuntary part of the event. Suddenly, phones started getting notifications about needing to enter a password Apple ID or transfer it to TV set-top box Apple TV. The device works exactly like this – it uses the features of the iPhone and Bluetooth protocols and shows on the screen notification in the mind of the person who appears when a smartphone detects a new one headphones Apple AirPods. Many users, seeing the Apple brand notification, without a shadow of a doubt will enter their password, which will immediately be sent to the attacker.

How it all works

The author of the unnamed device is a conference participant Jai box (Jae Bochs), working in the field of information security. In a small black box, it fits a cheap single-board computer Raspberry Pi Zero 2 W worth $15 (1410 rubles) and dimensions 65×30 mm, release in October 2021, this PC has Wi-Fi moduleas indicated by the index “W” in its name, and it is not without a Bluetooth module, but the author. boyfriend put a separate Bluetooth adapter in the case. He chose it on the principle of having drivers for it below Linux.

Also, the device is equipped with two antennas and an external one accumulator. There is nothing more “to do” in it.

Demonstration of the device

The author of the device said that the Bluetooth LE protocol is used by the iPhone to connect, for example, to wireless headset, allows nearby devices to “talk” to each other even when the user turns off Bluetooth on the phones through the Control Center. All he had to do was take advantage of this and write specialized software, and he ended up with a device that could send fake notifications to nearby iPhones. And since many now almost never close Bluetooth module even in the “Control Point”, from it smartphone communicating with headphones, it is not difficult to find a potential victim, which was clearly demonstrated by Box’s “performance” at Def Con 2023.

positive hacker, poor hacker

Bóks acted in positive faith, in the style of “white” hackers, and did not add functions to save user passwords to the software he wrote. In other words, sent by his creation notification not 100% real – no matter what the user enters in the field, this data will not be sent anywhere.

But Box openly stated that if he wanted, he could add a few extra lines of code and harvest the passwords of Def Con attendees. By this, he wanted to show that a device assembled on the knee from components available on the market and costing very little can pose a serious danger to users.

He drew particular attention to the fact that even users who turn off the Bluetooth module on their iPhone when they do not need it are still at risk. hacker attack. The vast majority of iPhone owners turn off Bluetooth through the “Control Center” – a drop-down menu at the top (on older ones). iPhone and the physical button Home is left below). But according to Box, this is not enough to completely turn off Bluetooth – this can only be done in the settings menu, which not everyone will find convenient and fast. And click on the Bluetooth icon in the Control Center to simply activate the protocol Bluetooth LE (Low Energy), which allows nearby devices to continue exchanging small data packets with each other.

It is this feature that makes it possible to use devices similar to the one in which Box is assembled to hack the iPhone. Jai himself said so Apple known about the problem since at least 2019, but did nothing to fix it. In his opinion, one might add iOS at least a warning about this so that users are aware of possible dangers.