iPhone 13 Pro Hacked
Muhammad Zaryaab Ahmed*1
#
National University of Sciences & Technology
1
zaryaabahmed18@gmail.com
Abstract— This document provides information about the iPhone 13
Pro. This document provides information about the hackers that who
hacked the iPhone. This document also provides information about
the vulnerabilities and how those vulnerabilities were exploited by
those hackers.
I. INTRODUCTION
Apple has long emphasized privacy as one of its primary
selling points for its products. However, several Chinese
white-hat hackers got into Apple's newest iPhone 13 Pro
running iOS 15.0.2 in under a second during a recent
Hackathon competition. The recent hacking competition
Tianfu Cup held in China. It is a popular cyber-security
competition. Not one, but two hacking teams were able to
breach the iPhone 13 Pro in a couple of seconds. The two
teams who hacked the iPhone in record time were
1. Kunlun Lab Team
2. Team Pangu
II. How it got hacked
Team Pangu was able to jailbreak the iPhone remotely in 1
second. As team Pangu is the most popular in jailbreak
community. However, it took generous amount of time to
prepare for them to hack the iPhone in only 1 second. As
iPhone is considered one of the most secure devices out there.
The hack resulted in gaining the root access to the app which
allowed them to jailbreak the new iPhone 13 Pro. On the
secondhand Kunlun Lab exploited a vulnerability in Safari for
iOS 15 to get into the new iPhone 13 pro. The CEO of
Kunlun Lab, who is also the former CTO of the internet
security company Qihoo 360, broke into the device live in
merely 15 seconds. Participants had to get around Apple's
Pointer Authentication Code (PAC), a security mechanism (in
practice, a cryptographic signature of pointer values) that
Apple has introduced at the chip level. The Safari browser
was triggered when a user clicked on a carefully faked link by
the attacker. Remote code execution vulnerabilities allowed
attackers to remotely execute attack commands. After
successfully bypassing the Safari browser protection
mechanism, the hacker used multiple vulnerabilities in the
iOS15 kernel and the A15 chip to launch a combined attack,
successfully bypassing multiple security protection
mechanisms and gaining full control of the iPhone 13 Pro. It
allowed the hacker to access photo albums, apps, and even
delete data directly from the device or execute other arbitrary
commands.
III. Vulnerabilities
Even before the launch of the iPhone 13 pro and the new iOS
version 15 a person participated in Apple Security bounty
program and reported four 0-day vulnerabilities between
March 10 and May 4. Apple was able to patch one of the
vulnerabilities before iOS 15 but the rest of the three
vulnerabilities were not patched at the time of launch of
iPhone 13 and iOS 15. The vulnerability that was exploited
was of Safari browser and a Phissing link was used to exploit
the vulnerability. The team used a “remote code execution
exploit of the mobile Safari web browser” to break through
the iPhone 13 Pro. Remote code execution is a class of
software security flaws/vulnerabilities. Any weak point in the
code can allow remote code execution. According to Apple,
the flaw can allow an application to “execute arbitrary code
with kernel privileges.” That means a hacker-controlled iOS
app could tap the vulnerability to hijack an iPhone since
the kernel controls the core of the operating
system. IOFrameBuffer: An application may be able to
execute arbitrary code with kernel privileges.
The four vulnerabilities are
1. Gamed 0-day
2. Nehelper Enumerate Installed Apps 0-day
3. Nehelper Wifi Info 0-day
4. Analyticsd (fixed in iOS 14.7)
IV. Safety Precautions
Apple Security Bounty: As part of Apple’s commitment to
security, they reward researchers who share with them critical
issues and the techniques used to exploit them. They make it a
priority to resolve confirmed issues as quickly as possible in
order to best protect customers. Security notice CVE-2021-
30883 mentions recent vulnerabilities and how they are
working on them but the full reports isn’t disclosed yet.
There are different categories of the bounties. e.g.
 iCloud
 Device via physical attacks etc.
V. Consequences
After the attack on iPhone 13 pro, Apple announced multiple
emergency updates. The barrage of iOS updates has often
been for serious vulnerabilities that were being utilized by
attackers in the wild. But the huge number of iOS security
fixes in 2021 is leading many people to ask: is Apple’s iPhone
less secure than it used to be?
“Part of the perception that there are more Apple
vulnerabilities now is because we are starting from a low
number historically,” says Sean Wright, SME security lead at
Immersive Labs.

VI. Recommendation
Apple should increase the number of security bounty
researchers. If they get any bounty from a researcher, they
should act on that immediately.