REVERSE ENGINEERING IOS 18 INACTIVITY REBOOT

Summary from the TLDR InfoSec newsletter

This article reverse engineers iOS 18's new inactivity reboot security feature by analyzing both debug strings in the SEPKeyStore kernel extension and decrypted Secure Enclave Processor (SEP) firmware. The SEP tracks device unlock times and triggers a forced reboot after 72 hours of inactivity. The feature is not wireless-dependent as previously rumored, but rather is implemented through direct SEP-to-kernel communication that forces devices into a secure "Before First Unlock" state. The SEP's involvement makes this feature highly tamper-resistant, requiring kernel-level code execution within the first three days to prevent the reboot, effectively creating an asymmetric defense that particularly impacts criminals while leaving law enforcement a narrow window for forensic analysis.