3 ms·

When you hear about someone jail breaking an iphone trough the browser, this is how. The fact that the browser works as a window to all tcp-sockets running on a

by Puts 10y ago

When you hear about someone jail breaking an iphone trough the browser, this is how. The fact that the browser works as a window to all tcp-sockets running on a device, it's the perfect way to exploit buffert overflows on a device that lacks a terminal. Also remember this with all your IoT appliances running on your local network. Even if it has a local IP-address, as long as you have a computer with a browser on the same network, you might as well consider your devices being publicly accessible from the rest of the internet.

0x0 10y ago
Did you just make that up?
andrewstuart2 10y ago
Remember, kids: a firewall is only one layer of your security. Make sure you always implement proper access control and guide users through changing the defaults.
- deleted 10y ago
  [deleted]
pomfpomfpomf3 10y ago
what? I haven't heard of a single jailbreak that worked like that. You got some links? edit: to people linking me safari CVEs (can't reply to you all) - these are memory corruptions. Not accessing ports on localhost.
- lcmatt 10y ago
  jailbreakme took advantage of a Safari bug. All you needed to do was go to the website, hit a button and wait a few minutes.
  - phpnode 10y ago
    That's a very different attack vector to the one in this post - buffer overflow vs legit service running on open ports unbeknownst to the user
- ChrisClark 10y ago
  I know one of the original iPhone and iPod Touch jailbreaks worked that way. I just went to a website and it automatically rooted and installed the homebrew app for me.
- iLoch 10y ago
  Since no one has provided you with a link, here's one such approach: http://www.redmondpie.com/how-to-jailbreak-ios-9.3.3-using-safari-no-computer-required/ http://www.redmondpie.com/how-to-jailbreak-ios-9.3.3-using-s... I think one of the first sites to do it was this one: https://jailbreakme.qoid.us/ https://jailbreakme.qoid.us/
  - nneonneo 10y ago
    Your first link appears to require the installation of an app on the phone (after installing a dev certificate). The app, running arbitrary native code, performs the actual jailbreak (most likely using a chain of kernel exploits). The devs seem to have gotten around the App Store by using an approach like TestFlight, which allows apps to be deployed for development and wider testing purposes without going through the App Store.
- megalodon 10y ago
  This write-up by CitizenLab [1] describes the Trident iOS exploit chain. Excerpt: CVE-2016-4657 [2]: Visiting a maliciously crafted website may lead to arbitrary code execution CVE-2016-4655 [3]: An application may be able to disclose kernel memory CVE-2016-4656 [4]: An application may be able to execute arbitrary code with kernel privileges [1] https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ https://citizenlab.org/2016/08/million-dollar-dissident-ipho... [2] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4657 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4657 [3] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4655 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4655 [4] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4656 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4656
  - nneonneo 10y ago
    None of these exploits have anything to do with accessing TCP services using a browser. The only exploit there having anything to do with Safari, CVE-2016-4657, is a WebKit memory corruption (per your [1]: "The stage1 employs a previously undocumented memory corruption vulnerability in WebKit to execute this code within the context of the Safari browser (CVE-2016-4657).").
    - megalodon 10y ago
      You're right, of course. I realised my mistake after the delete link had disappeared. My bad!
nneonneo 10y ago
No, iPhone jailbreaks usually just exploit bugs in WebKit to obtain code execution in the context of the Safari process. There generally aren't any system services running TCP locally on iOS - iOS has much more sophisticated IPC mechanisms for that.

by Puts 10y ago

0x0 10y ago

Did you just make that up?

andrewstuart2 10y ago

Remember, kids: a firewall is only one layer of your security. Make sure you always implement proper access control and guide users through changing the defaults.

deleted 10y ago
[deleted]

pomfpomfpomf3 10y ago

what? I haven't heard of a single jailbreak that worked like that. You got some links? edit: to people linking me safari CVEs (can't reply to you all) - these are memory corruptions. Not accessing ports on localhost.

lcmatt 10y ago
jailbreakme took advantage of a Safari bug. All you needed to do was go to the website, hit a button and wait a few minutes.
- phpnode 10y ago
  That's a very different attack vector to the one in this post - buffer overflow vs legit service running on open ports unbeknownst to the user
ChrisClark 10y ago
I know one of the original iPhone and iPod Touch jailbreaks worked that way. I just went to a website and it automatically rooted and installed the homebrew app for me.
iLoch 10y ago
Since no one has provided you with a link, here's one such approach: http://www.redmondpie.com/how-to-jailbreak-ios-9.3.3-using-safari-no-computer-required/ http://www.redmondpie.com/how-to-jailbreak-ios-9.3.3-using-s... I think one of the first sites to do it was this one: https://jailbreakme.qoid.us/ https://jailbreakme.qoid.us/
- nneonneo 10y ago
  Your first link appears to require the installation of an app on the phone (after installing a dev certificate). The app, running arbitrary native code, performs the actual jailbreak (most likely using a chain of kernel exploits). The devs seem to have gotten around the App Store by using an approach like TestFlight, which allows apps to be deployed for development and wider testing purposes without going through the App Store.
megalodon 10y ago
This write-up by CitizenLab [1] describes the Trident iOS exploit chain. Excerpt: CVE-2016-4657 [2]: Visiting a maliciously crafted website may lead to arbitrary code execution CVE-2016-4655 [3]: An application may be able to disclose kernel memory CVE-2016-4656 [4]: An application may be able to execute arbitrary code with kernel privileges [1] https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ https://citizenlab.org/2016/08/million-dollar-dissident-ipho... [2] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4657 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4657 [3] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4655 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4655 [4] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4656 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4656
- nneonneo 10y ago
  None of these exploits have anything to do with accessing TCP services using a browser. The only exploit there having anything to do with Safari, CVE-2016-4657, is a WebKit memory corruption (per your [1]: "The stage1 employs a previously undocumented memory corruption vulnerability in WebKit to execute this code within the context of the Safari browser (CVE-2016-4657).").
  - megalodon 10y ago
    You're right, of course. I realised my mistake after the delete link had disappeared. My bad!

nneonneo 10y ago

No, iPhone jailbreaks usually just exploit bugs in WebKit to obtain code execution in the context of the Safari process. There generally aren't any system services running TCP locally on iOS - iOS has much more sophisticated IPC mechanisms for that.