8 ms·

I might be missing something, but has there ever been any exploit (or string of simultaneous exploits) for iOS or android which meets all the criteria? It must

I might be missing something, but has there ever been any exploit (or string of simultaneous exploits) for iOS or android which meets all the criteria? It must be through a text message or web page, it must be remote, reliable, silent, require no interaction, must be entirely comprised of 0-day exploits throughout the whole chain, must affect multiple architectures and all supported devices, and must bypass all security checks to allow full root access.

captainmuon 11y ago
You used to be able to jailbreak one of the first iPhones and install Cydia just by visiting some page in Safari and clicking on a button, IIRC. I never did this myself, so my memories might be inaccurate though.
- SlashmanX 11y ago
  You're correct. jailbreak.me I think it was called
  - mbrd 11y ago
    It was always amusing to visit the Apple store and see a jailbroken iPhone on display when this vulnerability worked.
  - outadoc 11y ago
    And it was resurrected later on - by comex, I think.
- deleted 11y ago
  [deleted]
- haywardsmyfault 11y ago
  Right! One of the famous initial iPhone OS exploits involved a vulnerability in LibTiff. Decoding a crafted .tiff in Safari would grant the site's javascript root access. Read more: https://books.google.com/books?id=1kDcjKcz9GwC&pg=PA9&lpg=PA9#v=onepage&q&f=false https://books.google.com/books?id=1kDcjKcz9GwC&pg=PA9&lpg=PA...
- epmatsw 11y ago
  Yep, it was a pdf parsing exploit I believe.
- josu 11y ago
  It was actually a clever "Slide to Jailbreak" rather than a click. https://en.wikipedia.org/wiki/JailbreakMe https://en.wikipedia.org/wiki/JailbreakMe
concernedctzn 11y ago
Yes, the stagefright vulnerability in Android (http://arstechnica.com/security/2015/07/950-million-android-phones-can-be-hijacked-by-malicious-text-messages/ http://arstechnica.com/security/2015/07/950-million-android-...)
- deleted 11y ago
  [deleted]
- soisses 11y ago
  The stagefright bugs gave control over the media-player daemon of Android. This daemon is not running as root, it's even jailed with SELinux, but it has some interesting permissions like microphone-access. Despite the media hype you can't root your phone with the stagefright bugs and so it wouldn't qualify for the bounty.
  - concernedctzn 11y ago
    Some of those other interesting permissions are the ability to open arbitrary network/bluetooth sockets, read/write to external storage, and access the camera[1]. Mediaserver is not full root but it is pretty privileged. Given all of this access it wouldn't take much work to incorporate another privilege escalation bug to get root on the phone anyway, and there is zero user interaction. [1] https://www.blackhat.com/docs/us-15/materials/us-15-Drake-Stagefright-Scary-Code-In-The-Heart-Of-Android.pdf https://www.blackhat.com/docs/us-15/materials/us-15-Drake-St...
    - soisses 11y ago
      There isn't much in the list that applications like Hangout or Chrome don't have anyway. It's still a very serious vulnerability, but the overstating is just clever marketing by a security company.
  - saurik 11y ago
    > Despite the media hype you can't root your phone with the stagefright bugs and so it wouldn't qualify for the bounty. Alone? No. As part of a "chain" of exploits, which is what this bounty is calling for, in concert with a privilege escalation? Yes. That bug allowed for remote and silent (due to executing in a way which would allow it to suppress notifications of the incoming message) arbitrary code execution as a user on the device, which, even as a user with minimal permissions or which has been sandboxed in some way, affords you the ability to do much much more on the device than you could before the exploit. FWIW, the actual release included a demo of rooting a device on stage; they have a video with a similar demo. I presume the second bug they were using was an already-fixed kernel bug, but if you have something like stagefright your next step is to go hunting for such a bug. (Regardless, the question you were responding to was more about how most of the exploits people put together do not satisfy the "remote" and "silent" parts, as opposed to the "I got root" part; the latter is comparatively easy.) https://www.youtube.com/watch?v=PxQc5gOHnKs https://www.youtube.com/watch?v=PxQc5gOHnKs

captainmuon 11y ago

You used to be able to jailbreak one of the first iPhones and install Cydia just by visiting some page in Safari and clicking on a button, IIRC. I never did this myself, so my memories might be inaccurate though.

SlashmanX 11y ago
You're correct. jailbreak.me I think it was called
- mbrd 11y ago
  It was always amusing to visit the Apple store and see a jailbroken iPhone on display when this vulnerability worked.
- outadoc 11y ago
  And it was resurrected later on - by comex, I think.
deleted 11y ago
[deleted]
haywardsmyfault 11y ago
Right! One of the famous initial iPhone OS exploits involved a vulnerability in LibTiff. Decoding a crafted .tiff in Safari would grant the site's javascript root access. Read more: https://books.google.com/books?id=1kDcjKcz9GwC&pg=PA9&lpg=PA9#v=onepage&q&f=false https://books.google.com/books?id=1kDcjKcz9GwC&pg=PA9&lpg=PA...
epmatsw 11y ago
Yep, it was a pdf parsing exploit I believe.
josu 11y ago
It was actually a clever "Slide to Jailbreak" rather than a click. https://en.wikipedia.org/wiki/JailbreakMe https://en.wikipedia.org/wiki/JailbreakMe

concernedctzn 11y ago

Yes, the stagefright vulnerability in Android (http://arstechnica.com/security/2015/07/950-million-android-phones-can-be-hijacked-by-malicious-text-messages/ http://arstechnica.com/security/2015/07/950-million-android-...)

deleted 11y ago
[deleted]
soisses 11y ago
The stagefright bugs gave control over the media-player daemon of Android. This daemon is not running as root, it's even jailed with SELinux, but it has some interesting permissions like microphone-access. Despite the media hype you can't root your phone with the stagefright bugs and so it wouldn't qualify for the bounty.
- concernedctzn 11y ago
  Some of those other interesting permissions are the ability to open arbitrary network/bluetooth sockets, read/write to external storage, and access the camera[1]. Mediaserver is not full root but it is pretty privileged. Given all of this access it wouldn't take much work to incorporate another privilege escalation bug to get root on the phone anyway, and there is zero user interaction. [1] https://www.blackhat.com/docs/us-15/materials/us-15-Drake-Stagefright-Scary-Code-In-The-Heart-Of-Android.pdf https://www.blackhat.com/docs/us-15/materials/us-15-Drake-St...
  - soisses 11y ago
    There isn't much in the list that applications like Hangout or Chrome don't have anyway. It's still a very serious vulnerability, but the overstating is just clever marketing by a security company.
- saurik 11y ago
  > Despite the media hype you can't root your phone with the stagefright bugs and so it wouldn't qualify for the bounty. Alone? No. As part of a "chain" of exploits, which is what this bounty is calling for, in concert with a privilege escalation? Yes. That bug allowed for remote and silent (due to executing in a way which would allow it to suppress notifications of the incoming message) arbitrary code execution as a user on the device, which, even as a user with minimal permissions or which has been sandboxed in some way, affords you the ability to do much much more on the device than you could before the exploit. FWIW, the actual release included a demo of rooting a device on stage; they have a video with a similar demo. I presume the second bug they were using was an already-fixed kernel bug, but if you have something like stagefright your next step is to go hunting for such a bug. (Regardless, the question you were responding to was more about how most of the exploits people put together do not satisfy the "remote" and "silent" parts, as opposed to the "I got root" part; the latter is comparatively easy.) https://www.youtube.com/watch?v=PxQc5gOHnKs https://www.youtube.com/watch?v=PxQc5gOHnKs