OneKey founder: Old iPhone models storing mnemonic phrases pose hardware-level risks, and airplane mode cannot provide protection.

BlockBeats news, November 1: OneKey founder Yishi posted a reminder that restoring an old iPhone to factory settings, turning on airplane mode, and dedicating it solely to storing wallet mnemonic phrases does not mean it is secure. iPhone 11 and earlier models have BootROM hardware vulnerabilities that cannot be fixed through iOS updates. After an attacker gains physical access to the device, they can execute code before iOS boots via the USB interface and custom hardware, and airplane mode cannot prevent such attacks.

Yishi mentioned that iPhone 4S through iPhone X are affected by the checkm8 vulnerability disclosed in 2019, while iPhone XS, XR, the 11 series, and the second-generation iPhone SE are affected by the usbliter8 research disclosed in June this year. However, BootROM vulnerabilities themselves do not mean attackers can directly obtain mnemonic phrases; protections such as the device passcode and Secure Enclave still exist, but older system versions, simple passwords, and weaker encryption mechanisms in wallet apps may further expand the risk.

In addition, older iOS versions may also be affected by malicious charging device attacks. Yishi recommends that users who use iPhones to store mnemonic phrases should migrate to iPhone 12 or newer models, generate entirely new mnemonic phrases in a trusted environment, and transfer assets; they should also use longer alphanumeric passwords and avoid public USB charging ports. If a device has been out of the owner's control for an extended period, assets should also be migrated as soon as possible.

He also reminded that iPhone 12 and newer models currently have no publicly disclosed BootROM vulnerabilities of the same kind; the risk for older devices exists at the chip level and cannot be eliminated simply by updating the system.