# usbliter8 — checkm8-style unpatchable BootROM/SecureROM exploit for Apple A12/A13 (and S4/S5) devices

> Paradigm Shift publicly released usbliter8, a tethered checkm8-style BootROM (SecureROM) exploit for Apple A12, A13, S4 and S5 silicon. A low-level flaw in the Synopsys DesignWare USB controller, combined with a firmware-side memory-protection misconfiguration, lets an attacker with physical access corrupt memory in DFU mode and gain SecureROM-level code execution before iOS loads — enabling unsigned iBoot and a 'PWND:[usbliter8]' device marking. The bug is burned into silicon and cannot be patched.

- **Published:** 2026-06-19T00:00:00Z
- **Last reviewed:** 2026-06-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0871
- **ID:** TL-2026-0871
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Paradigm Shift
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 18 June 2026 the security research group Paradigm Shift published 'usbliter8', a public BootROM (SecureROM) exploit for Apple devices powered by the A12 and A13 application processors and the S4/S5 watch SoCs — the first public boot-chain exploit to extend beyond the A11-and-earlier devices covered by axi0mX's 2019 checkm8 exploit. Source reporting (The Register, 9to5Mac, AppleInsider, MacRumors) and the public proof-of-concept repository describe the same root cause: a 'very low level bug' in the Synopsys DesignWare USB controller used by Apple's SecureROM. When the device is placed in Device Firmware Update (DFU) mode and the controller buffers incoming USB setup/data packets, specially crafted USB traffic triggers an incorrect memory write that corrupts SecureROM state and yields code execution at the earliest, most-privileged stage of the boot chain.

SecureROM is the immutable first-stage boot code 'burned into silicon during manufacturing'; because the flaw lives in this mask ROM (and an associated hardware-protection configuration), Apple cannot patch it with a software update — only hardware replacement removes exposure. The exploit is tethered: control is lost on reboot and must be re-applied over USB. Successful exploitation grants pre-iOS control sufficient to load custom, unsigned iBoot images without signature verification, modify DFU behaviour, and mark the compromised device by appending 'PWND:[usbliter8]' to its USB serial-number string.

The A13 variant is materially harder than the A12 variant because the A13 SecureROM enables ARM Pointer Authentication (PAC) to resist control-flow hijacking; the researchers developed a staged memory-corruption technique to defeat PAC on A13. Notably, the exploit does NOT compromise the Secure Enclave Processor (SEP): user passcodes and encrypted data remain protected behind the SEP boundary, limiting the practical impact to jailbreaking, device forensics/unlock-assistance and boot-chain research rather than direct data decryption.

The reference implementation runs from an external RP2350-class microcontroller (e.g. Waveshare RP2350, Pimoroni TINY2350, Raspberry Pi Pico 2) using a bit-banged PIO USB stack rather than a standard host USB stack, because the exploit is timing-sensitive and requires a custom USB device implementation. A Python control utility, usbliter8ctl (pyusb), drives demotion and raw iBoot loading after the BootROM is exploited. A11 devices are immune because their USB driver resets the relevant memory addresses, and A14-and-later SecureROM configures the hardware protections differently. No CVE/CVSS was assigned in the source material, and there is no reported in-the-wild malicious use; the threat qualifies on public-PoC availability and the supply-wide, unpatchable hardware footprint. Disclosure to Apple Product Security was coordinated prior to public release.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1200 Hardware Additions
- T1091 Replication Through Removable Media
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1542 Pre-OS Boot
- T1542 Pre-OS Boot
- T1553 Subvert Trust Controls
- T1211 Exploitation for Stealth
- T1556 Modify Authentication Process
- T1082 System Information Discovery
- T1495 Firmware Corruption

## Sources

- [Researchers drop checkm8-style BootROM exploit for A12 and A13 iPhones](https://www.theregister.com/security/2026/06/19/researchers-drop-checkm8-style-bootrom-exploit-for-a12-and-a13-iphones/5259028)
- [prdgmshift/usbliter8 — An A12/A13 SecureROM exploit (proof-of-concept)](https://github.com/prdgmshift/usbliter8)
- [New unpatchable exploit targets Apple devices with A12 and A13 chips](https://9to5mac.com/2026/06/18/new-unpatchable-exploit-targets-apple-devices-with-a12-and-a13-chips/)
- [A12 & A13 Apple devices face an unpatchable SecureROM vulnerability](https://appleinsider.com/articles/26/06/18/a12-a13-apple-devices-face-an-unpatchable-securerom-vulnerability)
- [Apple's A12 and A13 Chips Facing New Unpatchable Exploit](https://www.macrumors.com/2026/06/18/a12-and-a13-chips-facing-exploit/)
- [Apple Devices With A12, A13 Chips Face 'Unpatchable' Exploit, Says Researchers](https://www.itechpost.com/articles/236379/20260618/apple-devices-a12-a13-chips-face-unpatchable-exploit-says-researchers.htm)
- [MITRE ATT&CK — Pre-OS Boot: System Firmware (T1542.001)](https://attack.mitre.org/techniques/T1542/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0871