  When an iPhone is turned off, most wireless chips stay on. For instance, upon
user-initiated shutdown, the iPhone remains locatable via the Find My network.
If the battery runs low, the iPhone shuts down automatically and enters a power
reserve mode. Yet, users can still access credit cards, student passes, and
other items in their Wallet. We analyze how Apple implements these standalone
wireless features, working while iOS is not running, and determine their
security boundaries. On recent iPhones, Bluetooth, Near Field Communication
(NFC), and Ultra-wideband (UWB) keep running after power off, and all three
wireless chips have direct access to the secure element. As a practical example
what this means to security, we demonstrate the possibility to load malware
onto a Bluetooth chip that is executed while the iPhone is off.
