There are also shops in China that will upgrade the SSD in a mac mini for cheaper and they will do all the work of the DFU restore etc.
replies(3):
The Apple Mx CPUs had some secret test registers that allowed the bypassing of all hardware memory protections and which could be accessed by those who were aware of their existence, because they were not disabled after production, as they should have been. Combined with some software bugs in some Apple system libraries, this allowed an attacker to obtain privileged execution rights by sending an invisible message to the iPhone.
It is unknown whether the same secret test registers were also open in the laptop versions of the Apple Mx CPUs. There the invisible message attack route would have been unavailable, but malicious Web pages might have been able to use the same exploit.
This incredible security failure has been hot news for a couple of weeks, together with the long list of CVEs associated with it, and it has been also discussed on HN, but after that it has been quickly forgotten. Now most people still think that the Apple devices have good security, despite their history showing otherwise. I do not think that any other hardware vendor except Apple has been caught with a security bug so dumb as those unprotected hardware test registers.
This was not a theoretical security failure, but it was discovered because some unknown attackers had used it for a long time to spy on some iPhone owners. The attack had been discovered by studying the logs of WiFi access points, which had shown an unusually high outbound traffic coming from the iPhones, which were exfiltrating the acquired data.
You make it sound like this was a huge impact issue, it really wasn’t, theoretically everyone could be affected but in reality a negligible subset were.
The fact that Apple keeps secret many technical details of their CPUs, like the existence of those hardware test registers, does not improve the security of their devices, but it weakens the security considerably.
Because of the Apple secrecy policy, the existence of the backdoor has been known and exploited by very few, but the same secrecy has enabled those few to spy on any interesting target for several years, without being discovered.
Had the test registers been documented, someone would have noticed quickly that they are accessible when they should not be, and the vulnerabilities would have been patched by Apple a few years earlier.
As for the registers itself, I concede that information about those specifically could've been made available.