Security risks exposed following hack of Apple’s USB-C controller

Apple's proprietary ACE3 USB-C controller has been successfully breached by security researcher Thomas Roth, posing new security concerns for the tech giant, SiliconAngle reports.

The ACE3 controller, which is an integral component to the management of charging and data transfer tasks in Apple devices, was compromised using reverse-engineering techniques to exploit weaknesses in its firmware and communication protocols. Roth demonstrated how these vulnerabilities allow unauthorized actions such as bypassing security checks and injecting malicious commands.

The vulnerability was attributed to insufficient protections in the firmware, enabling attackers with specialized USB-C cables or devices to achieve low-level access to the controller and from there be able to manipulate compromised devices including emulating trusted accessories, intercepting sensitive data during transfers, or executing malicious commands. Experts said the integration of the ACE3 controller with internal systems raises significant risks, including the possibility of untethered jailbreaks and persistent firmware implants that can compromise the operating system. Although the hacking method is complex and details were disclosed only recently, the potential for malicious exploitation exists. Apple has not yet commented or released updates to address this vulnerability.