In a solemn reminder that no system is 100% safe and unhackable, it was announced over the weekend that security researchers have managed to successfully hack Apple’s proprietary ACE3 USB-C controller, which handles both power delivery and works as a sophisticated microcontroller with access to internal systems.
Introduced with iPhone 15 and iPhone 15 Pro, the ACE3 USB-C controller is much more than a standard USB-C chip; it also runs a complete USB stack and connects to internal devices buses including the Joint Test Action Group (JTAG) application processor and System Power Management Interface (SPMI) bus. The ACE3 features personalized firmware updates, disabled debug interfaces and cryptographically validated external flash memory.
All these capabilities make the chip both an integral part of Apple’s ecosystem and a very attractive target for both security researchers as well as for cybercriminals. However, the ACE3 USB-C controller, which is manufactured by Texas Instruments for Apple, is harder to exploit than its predecessor, the ACE2. The security researchers had to use more advanced hardware techniques to crack ACE3, while ACE2 was easier to exploit with software vulnerabilities.
In order to hack the ACE3 USB-C controller, researchers did extensive analysis on the ACE2 version to understand the architecture and vulnerabilities of that model. After using MacBook hardware exploits and custom macOS kernel modules, they managed to backdoor ACE2. In order to handle the more robust security enhancements of ACE3, the security team had to employ a combination of reverse engineering, RF side-channel analysis and an electromagnetic fault injection.
This combination allowed them to execute code using the chip, they were then able to measure the electromagnetic signals during the startup process in order to identify the moment firmware validation occurred. Using electromagnetic fault injection at this critical juncture gave them the ability to bypass validation checks and boot a modified firmware patch into the CPU.
A breakthrough of this nature has obvious implications for device security, given ACE3’s integration with the device’s internal systems. The security flaw achieved by researchers could lead to untethered jailbreaks, persistent firmware implants capable of compromising the main operating system or unauthorized access by malicious actors.
These advanced physical attacks, like fault injection and side-channel analysis, are becoming the preferred methods to exploit highly secure systems especially as companies like Apple implement increasingly effective security measures that make software based attacks less successful. Given this development into hacking the ACE3 USB-C controller, it is likely that Apple will respond by implementing additional countermeasures such as improved shielding or more robust fault detection mechanisms.
