The Apple Mx CPUs had some secret test registers that allowed the bypassing of all hardware memory protections and which could be accessed by those who were aware of their existence, because they were not disabled after production, as they should have been. Combined with some software bugs in some Apple system libraries, this allowed an attacker to obtain privileged execution rights by sending an invisible message to the iPhone.
It is unknown whether the same secret test registers were also open in the laptop versions of the Apple Mx CPUs. There the invisible message attack route would have been unavailable, but malicious Web pages might have been able to use the same exploit.
This incredible security failure has been hot news for a couple of weeks, together with the long list of CVEs associated with it, and it has been also discussed on HN, but after that it has been quickly forgotten. Now most people still think that the Apple devices have good security, despite their history showing otherwise. I do not think that any other hardware vendor except Apple has been caught with a security bug so dumb as those unprotected hardware test registers.
This was not a theoretical security failure, but it was discovered because some unknown attackers had used it for a long time to spy on some iPhone owners. The attack had been discovered by studying the logs of WiFi access points, which had shown an unusually high outbound traffic coming from the iPhones, which were exfiltrating the acquired data.
You make it sound like this was a huge impact issue, it really wasn’t, theoretically everyone could be affected but in reality a negligible subset were.
The fact that Apple keeps secret many technical details of their CPUs, like the existence of those hardware test registers, does not improve the security of their devices, but it weakens the security considerably.
Because of the Apple secrecy policy, the existence of the backdoor has been known and exploited by very few, but the same secrecy has enabled those few to spy on any interesting target for several years, without being discovered.
Had the test registers been documented, someone would have noticed quickly that they are accessible when they should not be, and the vulnerabilities would have been patched by Apple a few years earlier.
As for the registers itself, I concede that information about those specifically could've been made available.
Two minutes or less, 4 DNS entries.
I'm a lot less convinced than you are of the hardiness of Apple's security.
1) "I'm not a security researcher" (ethos; repeal to authority)
2) "I get" (pathos; personal opinion)
3) "distinct impression" (pathos; emotional appeal)
4) "good enough" (logos; implies security is immeasurable/infeasible to prove)
Now, I wouldn't get caught dead endorsing a company that I have to write so many excuses for. But they did warn you!
With direct physical access, a lot of things can be done which cannot be done remotely, e.g. attempting to boot from an external device, possibly using hardware fault injections to bypass protections against that, attempting to read data that has not completely decayed from the DRAM modules, replacing some hardware component or inserting an extra component that would enable spying in the future, making copies of an encrypted SSD/HDD with the hope that after making other copies of it in the future that will enable breaking the encryption , if that is done using an encryption mode that does not protect against this kind of attack, and so on.
I'll add some references:
https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa...
https://en.wikipedia.org/wiki/2010s_global_surveillance_disc...