Experts say a new feature in iOS 18.1 causes iPhone to reboot after few days of inactivity, which improves security and has caused concern among law enforcement
Apple quietly introduced code into iOS 18.1 which reboots the device if it has not been unlocked for a period of time …
404 MediaJoseph Cox
Context & Ripple Effects
Apple has previously tightened iPhone access paths through an inactivity limit on Lightning data transfer and later offered Lockdown Mode for users facing highly targeted threats. The reported idle-device behavior extends that security posture from a discretionary protection setting and a port-control measure into the operating system's default handling of inactive phones.
That matters because the same safeguard that improves protection of an unattended device can narrow the window in which law-enforcement agencies can work with a seized phone, explaining the immediate conflict around the change.
First-order effects
iPhone users on iOS 18.1 receive an additional security safeguard when a device remains locked and inactive for an extended period.
Law-enforcement agencies face greater uncertainty around access to inactive seized iPhones, and have already raised concerns about the behavior.
Second-order effects
The change reinforces Apple's device-security differentiation while increasing pressure on investigators to adapt procedures to shorter practical windows around inactive devices.
Security-focused customers and organizations gain another default protection layer without having to enable a separate mode, while support teams may need to distinguish intentional reboots from reliability problems.
Third-order effects
If Apple continues moving protections into default OS behavior, mobile-device security will increasingly be defined by automatic state changes rather than user-selected settings.
The recurring tension between stronger endpoint protections and investigative access is likely to keep device-access policy and technical controls intertwined, though the ultimate regulatory response remains uncertain.
The trend: Mobile platforms are shifting more security protections into automatic, default device behavior that reduces the exposure of unattended endpoints.
A clever security in iOS 18.1 is frustrating the police. iPhones will now reboot themselves after a period of inactivity if they've been unlocked. While this does make the lives of coos harder, it's also a great security solution for people whose phones get stolen.
https://www.404media.co/... Apple introduced a new feature in iOS 18.1 called ‘inactivity reboot’ which causes iPhones in an AFU (After First Unlock) state to reboot after a set period of inactivity. — This makes it harder for forensic tools to extract data from seized iPhones…
Apple indeed added a feature called “inactivity reboot” in iOS 18.1. This is implemented in keybagd and the AppleSEPKeyStore kernel extension. It seems to have nothing to do with phone/wireless network state. Keystore is used when unlocking the device. https://github.com/... [ima…
There's a new article with more details on when the new inactivity reboot is triggered on iOS 18. This is a cheap & great mitigation! While most people won't have their phone forensically analyzed, many more will have their devices stolen. It protects user data in both cases.
iOS 18.1 was released on October 28, 2024. This has nothing to do with recent news coverage where cops are blaming imaginary features for devices not staying in After First Unlock state. Devices likely crashed due to one of many bugs which exist, including already patched ones.
iOS 18.1 added an implementation of the auto-reboot timer for locked devices we've been using in GrapheneOS since June 2021: https://chaos.social/... This was one of our early generation protections against forensic data extraction. We added a lot more protections this year.
woah, this is a smart idea. if someone who follows me happens to be at apple or connected to the team here, i would imagine implementing a shorter countdown on Lockdown Mode or something like that would be a good idea
New from 404 Media: we've confirmed that Apple quietly introduced code that automatically reboots an iPhone if it hasn't been unlocked after a period of time. This is why cops are being mysteriously locked out of iPhones they're trying to search. https://www.404media.co/...
@psyv282j9d @vanhoefm keybagd seems to only report inactivity times using the analytics framework, while the kernel extension checks for further options, informs user space about the initiated reboot, and then attempts to reboot. There's definitely some logic around this and not …