Experts say a new feature in iOS 18.1 causes iPhone to reboot after few days of inactivity, which improves security and has caused concern among law enforcement
Apple quietly introduced code into iOS 18.1 which reboots the device if it has not been unlocked for a period of time …
That matters because a reboot changes the device’s access condition after it has sat unused, while law-enforcement agencies are already voicing concern about the resulting investigative friction.
First-order effects
iPhones left locked and unused for the reported interval will reboot, moving them into a more restrictive post-restart state and improving protection against unauthorized access.
Law-enforcement workflows that depend on obtaining access to a seized but still-running iPhone face a narrower window before the device restarts.
Second-order effects
Forensic-access vendors and investigators will need to adapt collection procedures around faster physical isolation and device-state preservation rather than assuming a locked device remains continuously accessible.
Apple’s security support burden may rise if users interpret a deliberate reboot as a reliability fault, echoing how prior iOS reboot and shutdown behavior became a visible product issue.
Third-order effects
If Apple continues to make device state automatically more restrictive over time, endpoint security will increasingly be enforced by default operating-system behavior rather than settings users must remember to enable.
The recurring tension between strong default encryption protections and lawful-access demands is likely to persist as mobile platforms reduce the usefulness of physical possession alone.
The trend: This is one instance of mobile platforms shifting toward automatic, defense-in-depth protections that harden devices when users are absent.
A clever security in iOS 18.1 is frustrating the police. iPhones will now reboot themselves after a period of inactivity if they've been unlocked. While this does make the lives of coos harder, it's also a great security solution for people whose phones get stolen.
https://www.404media.co/... Apple introduced a new feature in iOS 18.1 called ‘inactivity reboot’ which causes iPhones in an AFU (After First Unlock) state to reboot after a set period of inactivity. — This makes it harder for forensic tools to extract data from seized iPhones…
Apple indeed added a feature called “inactivity reboot” in iOS 18.1. This is implemented in keybagd and the AppleSEPKeyStore kernel extension. It seems to have nothing to do with phone/wireless network state. Keystore is used when unlocking the device. https://github.com/... [ima…
woah, this is a smart idea. if someone who follows me happens to be at apple or connected to the team here, i would imagine implementing a shorter countdown on Lockdown Mode or something like that would be a good idea
New from 404 Media: we've confirmed that Apple quietly introduced code that automatically reboots an iPhone if it hasn't been unlocked after a period of time. This is why cops are being mysteriously locked out of iPhones they're trying to search. https://www.404media.co/...
There's a new article with more details on when the new inactivity reboot is triggered on iOS 18. This is a cheap & great mitigation! While most people won't have their phone forensically analyzed, many more will have their devices stolen. It protects user data in both cases.
iOS 18.1 was released on October 28, 2024. This has nothing to do with recent news coverage where cops are blaming imaginary features for devices not staying in After First Unlock state. Devices likely crashed due to one of many bugs which exist, including already patched ones.
iOS 18.1 added an implementation of the auto-reboot timer for locked devices we've been using in GrapheneOS since June 2021: https://chaos.social/... This was one of our early generation protections against forensic data extraction. We added a lot more protections this year.
@psyv282j9d @vanhoefm keybagd seems to only report inactivity times using the analytics framework, while the kernel extension checks for further options, informs user space about the initiated reboot, and then attempts to reboot. There's definitely some logic around this and not …