Secure Reset

Question

Level 1

11 points

Secure Reset

Let's assume my iPhone has been hacked. Maybe I had an old IOS with a bug or maybe it's something new but somebody installed something like a rootkit on it.

How can you make sure the phone is clean again by wiping it? How would you know the phone does not just act as if it got wiped?

Can an iPhone be reset so it absolutely safe nothing bad is still on it? (Assuming no hardware modifications and Apple playing by the rules and firmware signatures have not been compromised)

I'm asking in the context that even keyboard firmware has been used in the past to reinstall rootkits after the mac has been wiped for example. Seems really hard to be sure of anything these days ...

Thanks for the help guys!

Posted on Dec 24, 2022 11:08 AM

Reply

Answer 1

Top-ranking reply

IdrisSeabright

Community+ 2026

Level 10

188,901 points

Dec 24, 2022 1:16 PM in response to m.schwaller

You have two choices: 1) you do a factory reset according to Apple’s instructions and assume that it works (which, given the amount of money and effort Apple puts into security doesn’t seem unreasonable) or 2) you get rid of the device because you will never believe that it’s secure. There is no way you, as an end user, can do the forensics necessary to prove that the device is 100% secure.

You have yet to give any reason why you think the phone is compromised so I’m not sure what is causing this level of distress. Your time would be far better spend making sure your accounts, such as your Apple ID, email accounts, bank accounts are secure. Those are all far more likely to be compromised than your phone.

Reply

Answer 2

m.schwaller Author

Level 1

11 points

Dec 26, 2022 1:17 PM in response to m.schwaller

The best thing you can do is to use the DFU mode. While it is not clear on how difficult it would be to intercept that, it does involve some physical button combos that may be very resistant to being hacked. Here some documentation on how to do it: https://www.tenorshare.net/iphone-11/dfu-restore-iphone-11.html?gclid=CjwKCAiAqaWdBhAvEiwAGAQltoXF9qua9_rkQ1VM-Jqj0tEf31d4sgGr_W-V-ZtNnbPru_vKn1DiLRoCYDwQAvD_BwE

And, no, the "Factory Reset" is not the way to go. (Sadly it seems impossible to change "the best answer" now -.-)

@Lawrence Finch - thank you for your input and confirmation!

Reply

Answer 3

m.schwaller Author

Level 1

11 points

Dec 26, 2022 7:53 AM in response to m.schwaller

After some research and the input of the members the conclusion is the following:

It is not possible to securely reset an iPhone.

Factory Reset on the device itself is the only option and if your phone is indeed hacked you cannot trust that function anymore.

Reply

Answer 4

Dec 26, 2022 1:03 PM in response to m.schwaller

A DFU restore replaces everything on the phone with a clean copy of the firmware. As long as you don’t restore a backup the phone will be “clean"

Reply

Answer 5

m.schwaller Author

Level 1

11 points

Dec 26, 2022 1:00 PM in response to m.schwaller

BTW: I'm currently thinking using the recovery mode should give you additional security by using physical key combos that might be harder to intercept by a hacker: If your iPhone won't turn on or is frozen - Apple Support

Reply

Answer 6

muguy

Level 10

92,006 points

Dec 24, 2022 11:11 AM in response to m.schwaller

Factory reset the device.

Unless you have jailbroken your phone or given it to someone for a few hours along with your username and password, you haven't been hacked.

Reply

Answer 7

muguy

Level 10

92,006 points

Dec 24, 2022 12:19 PM in response to m.schwaller

Factory reset.

Reply

Answer 8

Dec 24, 2022 1:03 PM in response to m.schwaller

You can never by 100% sure that your phone is secure. And for you, I suspect the 99.9% likelihood that it is secure will never be good enough. Get rid of all smart phone. Get a basic phone with a prepaid SIM and change the number regularly.

Reply

Answer 9

Dec 26, 2022 1:38 PM in response to m.schwaller

Here’s a better DFU mode tutorial→How To Put An iPhone In DFU Mode, The Apple Way

Reply

Answer 10

m.schwaller Author

Level 1

11 points

Dec 24, 2022 11:25 AM in response to muguy

Let's assume it's a second hand phone - a person I don't know sold it to me. They may have jailbroken it or not - I wouldn't know.

What now? How would you know the button "Factory Reset" does what it says?

Let's leave the discussion on how probable it is that i'm a target of a hacker aside for now please. Let's just say I have reason to believe my iPhone has been hacked, jailbroken and anything else bad that could happen to it. How can I make SURE everything is fine again? I mean really be sure?

Reply

Answer 11

m.schwaller Author

Level 1

11 points

Dec 24, 2022 11:36 AM in response to m.schwaller

Also, articles like this CNBCs "Apple iPhones can be hacked with spyware even if you don’t click on a link, Amnesty International says" and the fact that IOS16 now offers a "Lock Down" mode shows that it's not as unlikely an iPhone is hacked as one might think. Thank you for your response though!

Reply

Answer 12

muguy

Level 10

92,006 points

Dec 24, 2022 12:24 PM in response to m.schwaller

It's very very very very unlikely; almost improbable. You missed the other part of the article, "Attacks like the ones described are highly sophisticated, cost millions of dollars to develop, often have a short shelf life, and are used to target specific individuals." These are not universal tools.

Security is a continuum, lock down does little for the average user except to make the phone more difficult to use.

Reply

Answer 13

m.schwaller Author

Level 1

11 points

Dec 24, 2022 12:58 PM in response to muguy

So Apple just added the Lock Down mode for the two people that get hacked - lets assume i'm one of them. Are you saying all I can do is trust the "Factory Reset" button in the compromised iPhone? Or is there maybe some other version of a factory reset by USB that somehow uses the security hardware to restore confidence? Not here to troll but responding to security questions by 'don't worry about it' kinda defeats the purpose, no?

Reply

Answer 14

m.schwaller Author

Level 1

11 points

Dec 24, 2022 1:10 PM in response to IdrisSeabright

It is a fair point. However my question is only this:

If you do suspect something isn't right, how can I make sure everything is wiped? Trusting a button on a compromised phone seems a little wrong to me - thats all. Is there something better than pressing that button and pray to the NSA?

Imagine that phone holds parts of the key to a 100m$ intellectual property. Would you trust that button?

Reply

Answer 15

m.schwaller Author

Level 1

11 points

Dec 24, 2022 1:27 PM in response to IdrisSeabright

I was just hoping Apple came up with something cool and smart for this problem - seems when you get hacked once, all "Factory Reset" does, is calming you down and maybe it removes the tracker your wife installed ;-) Thanks for the detailed responses though - have a great time!

BTW: The solution NGRAVE came up with is to have two independent computing systems in the device. One that basically never changes and does nothing but receive the new "firmware" (the IOS of NGRAVE), validate its integrity with preinstalled signatures (signing is a multi person, multi day process) and if valid wipes the installed disk on a hardware level and copies the new one there. Maybe iPhone could learn something here :-)

Reply