Security firm shows how hackers can spoof Airplane Mode and take over an iPhone

Security firm Jamf published a report on Thursday that explains how it discovered a way to simulate Airplane Mode in iOS 16. With this fake mode, an attacker can gain access to your iPhone even though you may think it’s offline.

Jamf emphasized that this technique has not been observed in the wild and the technique isn’t exploiting a vulnerability in iOS 16. The report does not explain how an attacker would make these modifications to iOS 16, but it would obviously require the attacker to be able to log into the iPhone, which means that the attacker needs to be able to bypass Touch ID or Face ID or have knowledge of the passcode. The report also does not state if Apple has been alerted about the findings.

The process essentially replaces the Control Center button in iOS 16 with one that does nothing, so when the user turns on Airplane Mode, the cellular and Wi-Fi connections are still active. Jamf Threat Labs was also able to create a method that allows for the iOS 16 UI to look like it’s in Airplane Mode, with the Airplane Mode Control Center icon active, the cellular and Wi-Fi icons dimmed, and the airplane icon in the upper right corner.

Furthermore, Jamf Threat Labs added modifications that blocked apps from accessing cellular or Wi-Fi connections, and it was able to spoof iOS 16 connectivity alerts to instead show the type of alerts that appear while in Airplane Mode. For example, when launching Safari, instead of an alert asking if you want to allow Safari to use a wireless connection, the alert that appears is one that tells you to turn off Airplane Mode.

While most users associate Airplane Mode as a setting used during a flight to quickly shut down Wi-Fi, Bluetooth, and cellular, it can also be used to shut down online connections or save battery life.

iPhone and iOS malware and viruses are very rare because of Apple’s strong security measures. The main method of attack is through a software download, and the iPhone can only get apps through the App Store, which checks the integrity of each app it sells.  If an iPhone is jailbroken to allow for app installations from outside the App Store, it becomes more vulnerable. Users should also be cautious about the hotspots that are available to use. Learn more about iPhone malware and viruses. We also have tips on how to protect your phone from hackers.