FluGameAce007

6 ms·

1.
by FluGameAce007 1y ago
Disables request signing if the config “Bag” fails to load (e.g. DNS block, timeout). Unsigned requests are sent directly to Apple APIs. No fallback, no integrity checks. Replay and downgrade attacks are possible. Includes syslog evidence +
2.
by FluGameAce007 1y ago
If debug logic can be reactivated... even briefly, even locally; then all bets are off for things like firmware extraction, secure boot bypass, or SEP fault analysis.
3.
by FluGameAce007 1y ago
But the issue isn't about parsing log semantics... It's that a production device entered a state where normally fused-off debug logic became accessible. That shouldn’t be possible, regardless of how the logs were captured or named
4.
by FluGameAce007 1y ago
If debug logic is still active, attackers with physical access can dump firmware, extract secrets, or bypass protections that should be fused off. Think: stolen phones, shady repair shops, or border checks — cases where physical access + th
5.
by FluGameAce007 1y ago
The device "recovering" while entering debug mode on production hardware is the security issue. Fuses are supposed to prevent that. They don’t. That’s the flaw.
6.
by FluGameAce007 1y ago
If a circuit breaker melts and causes other circuits to misbehave, we don’t say “big whoop”... we call it a fire hazard.
7.
by FluGameAce007 1y ago
Yes, it’s a security flaw, because debug logic is active on production hardware that should have it permanently fused off. Worse, the system prunes logs aggressively, erasing the very diagnostic history that could expose this behavior. So n
8.
by FluGameAce007 1y ago
True.. I2C lockups are a known limitation, not a bug. But this isn’t about bus contention. The issue is that debug logic is active on production-fused silicon, despite dev-fused = 0 and debug = 0x0. That’s a hardware trust failure, not a de
9.
by FluGameAce007 1y ago
This isn't just a bug... it's a hardware-level oversight that can cause iPhones to silently fail during boot, leaving no logs, no recovery mode, and no forensic trace. The flaw is triggered by abrupt power loss (e.g. during browno
10.
Apple A17 Pro Chip Hardware Flaw?(github.com)
39 points by FluGameAce007 1y ago|26 comments
11.
by FluGameAce007 1y ago
Observed on a production-fused A16 Bionic devices (e.g., iPhone 14 Pro Max),the internal debug pathways activating under stock iOS (debug = 0x0, dev-fused = 0). SecureROM, firmware, and co-processors all exhibit debug behavior without jailb
12.
by FluGameAce007 1y ago
This post details an active vulnerability chain on iOS 18.6.2 involving malformed Siri Shortcuts that persist in the background, abuse system daemons, and tolerate TLS trust mismatches. Full report with logs and CVSS scoring available on Gi
13.
by FluGameAce007 1y ago
A forensic analysis of iOS 18.6 reveals a silent data exfiltration sequence initiated entirely by Apple system daemons — no app involved, no permission prompt, no UI indicator. In a ~3-second window, nsurlsessiond and symptomsd transferred
14.
by FluGameAce007 1y ago
"Preflight=yes" bypassing user prompts is not expected or documented behavior... period. The fact that internal system daemons can silently trigger access to TCC-protected domains (like Contacts, FaceID, Microphone, and Bluetooth)
15.
by FluGameAce007 1y ago
What is surprising is that it's accessing my camera, contact list and my mic...
16.
iOS 18.5 Bluetooth Privacy Vulnerabilities(github.com)
78 points by FluGameAce007 1y ago|25 comments
17.
by FluGameAce007 1y ago
Using only Apple’s official diagnostic tools (Console.app) on a clean, non-jailbroken iPhone 14 Pro Max, the following issues were observed: System daemons silently initiate Bluetooth Low Energy (BLE) scans without app activity or user inte
18.
Apple's Bluetooth trust persists after cryptographic failure (iOS 18.5)(substack.com)
2 points by FluGameAce007 1y ago|2 comments
19.
by FluGameAce007 1y ago
I discovered this while analyzing system logs during unrelated testing. What began as an anomaly led to repeatable behaviors — silent BLE scans, GPS activation, trust logic continuing even after keychain failures. I used Console.app on a cl
20.
iOS 1-Click Crypto Theft: Apple Fixed It, Google Shared It, Researcher Left Out(substack.com)
7 points by FluGameAce007 1y ago|1 comments
21.
by FluGameAce007 1y ago
In December 2024, I reported a one-click iOS vulnerability triggered by playing a malicious MP4 audio file via iMessage or SMS. The exploit chain included: AudioConverterService – memory corruption, AppleBCMWLAN.dext – kernel-level escalati
22.
iOS Exploit Chain and Remaining Unpatched Surfaces(josephgoydish2.substack.com)
2 points by FluGameAce007 1y ago|0 comments