usbliter8 Exploit Breaks SecureROM on Apple A12 and A13 Devices

Security researchers at Paradigm Shift disclosed usbliter8, a tethered BootROM exploit that achieves privileged SecureROM code execution on Apple devices using A12 and A13 processors, as well as Apple Watch S4/S5 chipsets. The exploit chains a flaw in the Synopsys DesignWare USB 2 controller with a firmware configuration weakness in the boot chain, allowing attackers with physical access to modify DFU mode, inject custom USB handlers, and boot unsigned iBoot images. Researchers said the issue affects immutable BootROM/SecureROM code, meaning software updates cannot fully fix vulnerable devices and hardware replacement is the most effective mitigation.

The public release included a GitHub repository and technical write-up describing hardware requirements and exploitation steps. Because the bug is exposed through low-level USB behavior that typical host stacks cannot reach, the exploit uses RP2350-based microcontroller boards such as the Waveshare RP2350 USB-A, Waveshare RP2350 Zero, Pimoroni TINY2350, and Raspberry Pi Pico 2. Paradigm Shift said A11 devices are not vulnerable due to different USB driver behavior, while A14 and later platforms appear harder to exploit because DART is configured correctly; Apple Product Security was notified before publication.