A hidden feature in iOS 18.1 will automatically reboot a locked iPhone when it is asleep but hasn’t been unlocked for a while, presumably as a security measure.
The feature has been identified as an “inactivity reboot,” and is similar to a feature found on Macs. The Mac version, known as “hibernation mode,” saves the state of the device to disk when put to sleep, in case the power fails or the battery runs out before the user can return to the machine.
By flushing the last state of the device, iPhone users are better protected from forensic searches by law enforcement or other entities. The change also makes it more difficult for anyone to break into the device using brute-force or other methods.
The reboot timer is not reliant on charging or network functions, and is only tied to inactivity since the last unlock. This means the reboot will take place after a period of time, even if network connections are not maintained.
Preventing personal security compromises
Christopher Vance, a forensic specialist at Magnet Forensics, was quoted in a expert group chat as saying “We have identified code within iOS 18 and higher that is an inactivity timer. This timer will cause devices in an AFU state to reboot to a BFU state after a set period of time, which we have also identified.”
The synonyms refer to the state of the device After First Unlock, and Before First Unlock, where the iPhone has no still-open apps or content. Before First Unlock makes it more difficult for bad actors or law enforcement to use forensic tools to “crack” the device.
The time between a user putting the device to sleep and the automatic reboot appears to be around four days, or 96 hours. Magnet Forensics has recently acquired Grayshift, the company behind the cracking tool GrayKey.
“Remember that the real threat here is not police,” cryptographer Matthew Green from John Hopkins University told 404 Media. “It’s the kind of people who will steal your iPhone for malign purposes. This feature means that if your phone gets stolen, the thieves can’t nurse it along for months until they develop the tech to crack it.”
“I would bet that rebooting after a reasonable inactivity period probably doesn’t inconvenience anyone, but does make your phone a lot more secure,” Green added. “So it seems like a pretty good idea.”
