Researchers and Hackers Use Rare Dev-Fused Prototype iPhones to Unlock Security Secrets

If you've ever wondered how security researchers and hackers manage to bypass Apple's protections and security features to uncover iPhone vulnerabilities and other sensitive info, Motherboard is out today with a new report that has an answer.

Hackers and security researchers use rare "dev-fused" iPhones created for internal use at Apple. These dev-fused iPhones have not finished the production process and have many security features disabled. Motherboard describes them as "pre-jailbroken devices."

devfusediphone

A dev-fused ‌iPhone‌ image shared with Motherboard by collector Giulio Zompetti

Dev-fused iPhones are smuggled out of Apple where they can sell for thousands of dollars on the gray market. These iPhones are incredibly valuable due to the fact that they can be used to locate vulnerabilities able to impact release versions of the ‌iPhone‌.

On the back of dev-fused iPhones seen by Motherboard, there's a QR-code sticker, a separate barcode, and a decal that says "FOXCONN," referring to the factory that makes iPhones and other Apple products. Otherwise, the phones look like normal iPhones. That standard iPhone experience ends when the phone is turned on. When booted up, you briefly see a command line terminal. And then when it loads, gone are the sleek icons and colorful backgrounds of iOS.

Motherboard spent months researching dev-fused iPhones, talking to more than two dozen sources ranging from security researchers and Apple employees to rare phone collectors and jailbreakers, and found that researchers, hackers, and high-profile companies like Cellebrite or GrayKey use these dev-fused iPhones to uncover bugs that can later be exploited by law enforcement agencies.

A dev-fused ‌iPhone‌ was, for example, used in 2016 to study the Secure Enclave Processor, and security researchers were able to uncover valuable details on how it works. These dev-fused iPhones are stolen property and illegal to possess, but are apparently "widely used" in the ‌iPhone‌ hacking scene.

"If you are an attacker, either you go blind or with a few thousand dollars you have all you need," Luca Todesco, one of the most well-known iOS security researchers in the world, told Motherboard, referring to people who buy dev-fused iPhones. "Some people made the second choice."

Motherboard was able to find someone on Twitter who sells dev-fused iPhones, with a dev-fused ‌iPhone‌ X priced at around $1,800. The seller said that he's provided dev-fused iPhones to several security researchers and that he believes major security firms that hack iPhones also use them. Other sellers offer dev-fused iPhones at higher prices, and Motherboard found an ‌iPhone‌ XR priced at $20,000.

Dev-fused iPhones are paired with a proprietary Apple cable called Kanzi that can cost upwards of $2,000, that, when plugged into a Mac, provides access to internal Apple software that offers root access to the phone.

Most of these devices seem to be stolen from and smuggled out of factories like Foxconn in China. Apple is apparently "well aware" of the fact that dev-fused devices are available. Apple has "ramped up efforts" to keep these devices from leaving Foxconn and does go after dev-fused ‌iPhone‌ sellers.

Motherboard's full report can be read over on the Motherboard website, and it is a fascinating look at the world of ‌iPhone‌ hacking for anyone who is interested in how ‌iPhone‌ vulnerabilities are uncovered.

Top Rated Comments

AngerDanger Avatar
65 months ago


Oh, I've been there, man! Long nights spent hacking away at devices on top of my… alligator leather covered table.
Score: 26 Votes (Like | Disagree)
7thson Avatar
65 months ago
What's gray about selling stolen property?
Score: 11 Votes (Like | Disagree)
m4mario Avatar
65 months ago
Sometimes I forget how big Apple really has become. The kind of problems Apple faces, few companies need to face.
Score: 4 Votes (Like | Disagree)
tzm41 Avatar
65 months ago
So there are backdoors. I am guessing that because it's called "Dev-fused" that there is a hardware fuse that when blown during provisioning removes the ability of the phone to be used this way. That means that the restriction is by-passable.

The $2000 cable just means that encrypted communications is also required and the cable contains the encryption hardware and/or keys. So much for Apple's pie the eye security. Still better than the competitors, but not much challenge for the NSA.
I don't think "development units without security measures installed" are equal to "retail devices with backdoors installed".
Score: 4 Votes (Like | Disagree)
Aston441 Avatar
65 months ago
Hopefully someday a good completely open source (software and hardware) phone will come to market and we can leave all the proprietary bullpoo behind as a bad memory.
Score: 4 Votes (Like | Disagree)
magbarn Avatar
65 months ago
As long as Apple continues to be cheap and build their iPhones in a country that condones IP theft, expect this to continue...
Score: 4 Votes (Like | Disagree)

Popular Stories

iOS 17

10 New Things Your iPhone Can Do in Next Week's iOS 17.4 Update

Friday March 1, 2024 1:30 am PST by
Apple will this month release iOS 17.4, its biggest iPhone software update of the year so far, featuring a number of features and changes that users have been anticipating for quite a while. Below, we've listed 10 new things that your iPhone will be able to do after you've installed the update, which is projected to arrive by March 7. When the day arrives, be sure to check Settings ➝...
Apple Maps vs Google Maps Feature

Apple Maps vs. Google Maps: Which Is Better?

Friday March 1, 2024 7:10 am PST by
Apple Maps has been providing navigational guidance to Apple users for almost 13 and a half years now, and much has changed about the app in that time. However, according to data from Canalys, the overwhelming majority of iPhones in the U.S. still have Google Maps downloaded as an alternative to Apple Maps, which comes preinstalled on all iPhones. We want to hear from MacRumors readers. Which do...
apple tv plus banner

Apple TV+ Gains Over 50 Movies for a Limited Time

Friday March 1, 2024 6:29 am PST by
Apple TV+ today gained over 50 movies, adding to its back catalog of content for a limited time. The collection includes a large number of popular and classic titles. Subscribers can access the movies in a "Great Movies on Apple TV+" section in the Apple TV app. Some titles are also available in 3D. Movies in the collection include: 21 Jump Street 300 American Sniper Argo ...
airpods pro 2 pink

Apple Releases New Beta Firmware for AirPods Pro 2

Thursday February 29, 2024 11:41 am PST by
Apple today introduced a new beta firmware update for the AirPods Pro 2, both the USB-C and Lightning versions. The new firmware is version 6E188, up from the prior 6B34 firmware released in December. Apple does not often provide details or notes on what features might be included in the refreshed firmware, so it is unclear what's new. Note that this software is limited to developers at the...
iOS 18 Mock Feature Baubles

Will Your iPhone Support iOS 18? Here's What the Latest Rumor Says

Thursday February 29, 2024 7:29 am PST by
iOS 18 and iPadOS 18 are still over three months away from being unveiled, but we may already know which devices will be compatible with the updates. iOS 18 will be compatible with the same iPhone models as iOS 17, meaning that the iPhone XS, iPhone XS Max, and iPhone XR from 2018 will remain supported for at least another year, according to information shared this week by a source with a...
maxresdefault

Apple Spent More Than $10 Billion on Apple Car Before Canceling Project

Wednesday February 28, 2024 5:13 pm PST by
Apple spent more than $10 billion working on the Apple Car over the last decade, according to a report from The New York Times that details the issues the project faced during development. Apple first launched the project in 2014 and let it flounder for more than a decade before calling it off earlier this week. Subscribe to the MacRumors YouTube channel for more videos. Money was spent on...