Apple’s proprietary USB-C controller has officially been hacked – what you need to know

iPhone with USB-C charging cable — (Image credit: Shutterstock)

In a solemn reminder that no system is 100% safe and unhackable, it was announced over the weekend that security researchers have managed to successfully hack Apple’s proprietary ACE3 USB-C controller, which handles both power delivery and works as a sophisticated microcontroller with access to internal systems.

Introduced with iPhone 15 and iPhone 15 Pro, the ACE3 USB-C controller is much more than a standard USB-C chip; it also runs a complete USB stack and connects to internal devices buses including the Joint Test Action Group (JTAG) application processor and System Power Management Interface (SPMI) bus. The ACE3 features personalized firmware updates, disabled debug interfaces and cryptographically validated external flash memory.

All these capabilities make the chip both an integral part of Apple’s ecosystem and a very attractive target for both security researchers as well as for cybercriminals. However, the ACE3 USB-C controller, which is manufactured by Texas Instruments for Apple, is harder to exploit than its predecessor, the ACE2. The security researchers had to use more advanced hardware techniques to crack ACE3, while ACE2 was easier to exploit with software vulnerabilities.

In order to hack the ACE3 USB-C controller, researchers did extensive analysis on the ACE2 version to understand the architecture and vulnerabilities of that model. After using MacBook hardware exploits and custom macOS kernel modules, they managed to backdoor ACE2. In order to handle the more robust security enhancements of ACE3, the security team had to employ a combination of reverse engineering, RF side-channel analysis and an electromagnetic fault injection.

A breakthrough of this nature has obvious implications for device security, given ACE3’s integration with the device’s internal systems. The security flaw achieved by researchers could lead to untethered jailbreaks, persistent firmware implants capable of compromising the main operating system or unauthorized access by malicious actors.

These advanced physical attacks, like fault injection and side-channel analysis, are becoming the preferred methods to exploit highly secure systems especially as companies like Apple implement increasingly effective security measures that make software based attacks less successful. Given this development into hacking the ACE3 USB-C controller, it is likely that Apple will respond by implementing additional countermeasures such as improved shielding or more robust fault detection mechanisms.

More from Tom's Guide

Any Contract Length

12 Months Contracts

Showing 4 of 4 deals

Filters☰

McAfee+ Premium - Unlimited Devices

$49.99

View

McAfee+ Premium - Unlimited Devices

$49.99

View

TOPICS

Amber Bouman is the senior security editor at Tom's Guide where she writes about antivirus software, home security, identity theft and more. She has long had an interest in personal security, both online and off, and also has an appreciation for martial arts and edged weapons. With over two decades of experience working in tech journalism, Amber has written for a number of publications including PC World, Maximum PC, Tech Hive, and Engadget covering everything from smartphones to smart breast pumps.