Reverse Engineering iOS 18 Inactivity Reboot

> In law enforcement scenarios, a lot of the forensically relevant data is available in the AFU state. Law enforcement takes advantage of this and often keeps seized iPhones powered on, but isolated from the Internet, until they can extract data.

In Slovenia, devices have to be turned off the moment they are seized by their owner, prior to putting them into airplane mode.

Also when thieves or muggers rob someone, the first thing they do is turn on Airplane Mode or force power-off.

WHY the hell don't those actions require a passcode or bio authentication??

They could just put it in a foil-lined pocket instead.

I don't think people would be fine with being unable to power any electronic device down at need, even if they're not the owner.

It feels like something that needs to be as easy as possible, for safety reasons if not anything else.

Now what I'd like to see is an extension of their protocol that is used to locate iPhones that would also let them accept a "remote wipe" command, even when powered down.

You can definitely block AirPlane mode without a passcode on iOS. I disabled the access to the control center when the iPhone is locked. Therefore thieves won’t be able to do so.

This doesn't work if they steal it out your hand while it's unlocked.

You need to be able to forcibly power off the phone when it's frozen.

Slight mitigation to this is you can add an automation via the Shortcuts app to be triggered when airplane mode is enabled, and set the actions to immediately lock your device and disable airplane mode

Downside is that you need to manually disable the automation if you actually wish to use airplane mode (and also remember to re-enable it when done)

I assume apple has something similar to https://support.google.com/android/answer/15146908

Theft Detection Lock uses AI, your device's motion sensors, Wi-Fi and Bluetooth to detect if someone unexpectedly takes your device and runs away. If Theft Detection Lock detects that your device is taken from you, it automatically locks your device's screen to protect its content.

I've set two automations: 1) When airplane mode is activated, lock the screen. 2) When airplane mode is activated, turn it back off. That'll give me the most opportunity to either track it and/or lock it down remotely.

I can remember to disable the shortcut whenever I fly and need to enable it.

If they pop my SIM (my provider doesn't use eSIMs...) then there's a PIN on it to prevent use in another device.

FYI: Everyone should disable control center from the Lock Screen to prevent that attack (airplane mode activation while locked).

iPhones are still trackable while powered off, at least for a while.

Then obviously it should be an option for when you're traveling in places with a high risk of mugging.

"Why bother deterring the more-common low-effort risks if there are higher effort ways to thwart the deterrence?"

How often do muggers carry foil pockets even in first world countries? Certainly not in places where there's a mugging almost every week. Some way to track the device on its way to wherever they strip them off for parts would be helpful than not being to track it at all.

They don’t because they don’t have to. Make it necessary and they’ll switch within the week.

That’s still only the preplanned muggers. Not the opportunists who spot an unattended phone somewhere by chance.