{"id":24020,"date":"2022-01-10T16:43:28","date_gmt":"2022-01-10T16:43:28","guid":{"rendered":"https:\/\/www.kaspersky.co.uk\/blog\/what-is-noreboot-attack-and-how-to-protect-your-smartphone\/24020\/"},"modified":"2022-01-10T16:43:28","modified_gmt":"2022-01-10T16:43:28","slug":"what-is-noreboot-attack-and-how-to-protect-your-smartphone","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/what-is-noreboot-attack-and-how-to-protect-your-smartphone\/24020\/","title":{"rendered":"NoReboot: A fake restart to gain a foothold in the system"},"content":{"rendered":"

To be absolutely sure your phone isn\u2019t tracking you or listening in on any conversations, you might turn it off. It seems logical; that way, even if the phone is infected with serious spyware, it can\u2019t do anything.<\/p>\n

In addition, turning off or restarting a smartphone is one of the most reliable ways to fight such infections; in many cases, spyware \u201clives\u201d only until the next reboot because it cannot gain a permanent foothold in the operating system. At the same time, the vulnerabilities that allow malware to work even after a reboot are rare and expensive to exploit.<\/p>\n

However, this tactic might not work forever. Researchers have come up with a technique to bypass it using a method they have named NoReboot. In essence, this attack is a fake restart.<\/p>\n

What is NoReboot, and how does the attack work?<\/h2>\n

We want to note right off the bat that NoReboot is not a feature of any real spyware in use by attackers; rather, it\u2019s a so-called proof of concept<\/a> that researchers demonstrated under laboratory conditions. At this point it is hard to say whether the method will actually gain traction.<\/p>\n

For the demonstration, the researchers used an iPhone they \u201cinfected\u201d beforehand. Unfortunately, they haven\u2019t shared the technical details. Here\u2019s what happens in the demonstration:<\/p>\n