Researchers Boot Jailbroken iOS 27 on iPhone 11 Pro Using SecureROM Exploit
Security researchers have successfully booted a jailbroken version of iOS 27 on an iPhone 11 Pro by leveraging the usbliter8 SecureROM exploit, demonstrating a bootrom-level vulnerability that requires physical access.
Security researchers have achieved a significant milestone by booting a jailbroken build of iOS 27 on an iPhone 11 Pro, a feat made possible by combining the recently disclosed usbliter8 SecureROM exploit with a heavily modified custom firmware. This demonstration, targeting Apple's A13-powered iPhone 11 Pro, highlights how a bootrom-level vulnerability, coupled with physical access and specialized hardware in DFU mode, can bypass the stringent security measures inherent in Apple's boot chain.
The project, detailed in the usbliter8-fun GitHub repository, builds upon prior work and introduces specific patches for iOS 27.0 beta 2. The core of this achievement lies in the usbliter8 exploit, released by Paradigm Shift, which targets Apple A12 and A13 processors. Operating via USB Device Firmware Upgrade (DFU) mode, the exploit necessitates direct physical connection and specialized hardware, making it a high-barrier attack vector. Crucially, because SecureROM is immutable code embedded in silicon, vulnerabilities at this layer cannot be patched through standard software updates, posing a long-term security challenge for affected devices.
The specific implementation for the iPhone 11 Pro involves an RP2350-based Raspberry Pi Pico 2 configured as a USB exploit device. Once the target iPhone enters a compromised DFU state, researchers can load custom boot components and a modified iOS image. The process is not remote and demands significant technical preparation, including DFU access, a USB connection, compatible hardware, and detailed knowledge of the device's architecture.
The custom firmware developed for this jailbreak includes extensive modifications to kernel and userland components, designed to weaken several iOS security controls. These include bypasses for USB Restricted Mode, sandbox restrictions for /var/jb, and Apple Mobile File Integrity checks. Such modifications are essential for enabling the execution of unsigned or untrusted code, a fundamental requirement for any jailbroken environment.
To manage the instability introduced by incompatible or unavailable Secure Enclave Processor (SEP) components, researchers also modified system services. Patches were applied to prevent crashes in critical services like coreauthd and ctkd, and activation-related changes were implemented to make the modified device appear legitimate. Additionally, a Screen Time-related launchd job was disabled to avoid a Setup Assistant deadlock encountered during testing.
Despite the technical success, the resulting installation is highly experimental and comes with substantial limitations. The project documentation explicitly warns that restoring the custom firmware can lead to data loss and break critical services, including SEP functions, passcode support, Wi-Fi, baseband connectivity, Bluetooth, and various Apple services. Users are strongly advised against attempting this procedure on their primary devices.
Post-boot, the project supports USB-based SSH access and provides a bootstrap environment along with the Sileo package manager. However, normal network connectivity, such as Wi-Fi and cellular functions, may be unavailable, potentially requiring USB internet sharing from a connected computer. This research underscores the persistent security implications of SecureROM-level vulnerabilities on older Apple hardware, offering a pathway for researchers to study devices outside Apple's standard trust chain, even on newer iOS versions.
While usbliter8 was initially reported without a specific CVE, CVSS score, or public advisory, its existence highlights the ongoing cat-and-mouse game between security researchers and device manufacturers. The ability to bypass fundamental security layers, even with significant prerequisites, demonstrates the continuous need for robust security research and awareness.