5 ms·

what? I haven't heard of a single jailbreak that worked like that. You got some links? edit: to people linking me safari CVEs (can't reply to you all) - these

what? I haven't heard of a single jailbreak that worked like that. You got some links? edit: to people linking me safari CVEs (can't reply to you all) - these are memory corruptions. Not accessing ports on localhost.

lcmatt 10y ago
jailbreakme took advantage of a Safari bug. All you needed to do was go to the website, hit a button and wait a few minutes.
- phpnode 10y ago
  That's a very different attack vector to the one in this post - buffer overflow vs legit service running on open ports unbeknownst to the user
ChrisClark 10y ago
I know one of the original iPhone and iPod Touch jailbreaks worked that way. I just went to a website and it automatically rooted and installed the homebrew app for me.
iLoch 10y ago
Since no one has provided you with a link, here's one such approach: http://www.redmondpie.com/how-to-jailbreak-ios-9.3.3-using-safari-no-computer-required/ http://www.redmondpie.com/how-to-jailbreak-ios-9.3.3-using-s... I think one of the first sites to do it was this one: https://jailbreakme.qoid.us/ https://jailbreakme.qoid.us/
- nneonneo 10y ago
  Your first link appears to require the installation of an app on the phone (after installing a dev certificate). The app, running arbitrary native code, performs the actual jailbreak (most likely using a chain of kernel exploits). The devs seem to have gotten around the App Store by using an approach like TestFlight, which allows apps to be deployed for development and wider testing purposes without going through the App Store.
megalodon 10y ago
This write-up by CitizenLab [1] describes the Trident iOS exploit chain. Excerpt: CVE-2016-4657 [2]: Visiting a maliciously crafted website may lead to arbitrary code execution CVE-2016-4655 [3]: An application may be able to disclose kernel memory CVE-2016-4656 [4]: An application may be able to execute arbitrary code with kernel privileges [1] https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ https://citizenlab.org/2016/08/million-dollar-dissident-ipho... [2] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4657 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4657 [3] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4655 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4655 [4] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4656 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4656
- nneonneo 10y ago
  None of these exploits have anything to do with accessing TCP services using a browser. The only exploit there having anything to do with Safari, CVE-2016-4657, is a WebKit memory corruption (per your [1]: "The stage1 employs a previously undocumented memory corruption vulnerability in WebKit to execute this code within the context of the Safari browser (CVE-2016-4657).").
  - megalodon 10y ago
    You're right, of course. I realised my mistake after the delete link had disappeared. My bad!

lcmatt 10y ago

jailbreakme took advantage of a Safari bug. All you needed to do was go to the website, hit a button and wait a few minutes.

phpnode 10y ago
That's a very different attack vector to the one in this post - buffer overflow vs legit service running on open ports unbeknownst to the user

ChrisClark 10y ago

I know one of the original iPhone and iPod Touch jailbreaks worked that way. I just went to a website and it automatically rooted and installed the homebrew app for me.

iLoch 10y ago

Since no one has provided you with a link, here's one such approach: http://www.redmondpie.com/how-to-jailbreak-ios-9.3.3-using-safari-no-computer-required/ http://www.redmondpie.com/how-to-jailbreak-ios-9.3.3-using-s... I think one of the first sites to do it was this one: https://jailbreakme.qoid.us/ https://jailbreakme.qoid.us/

nneonneo 10y ago
Your first link appears to require the installation of an app on the phone (after installing a dev certificate). The app, running arbitrary native code, performs the actual jailbreak (most likely using a chain of kernel exploits). The devs seem to have gotten around the App Store by using an approach like TestFlight, which allows apps to be deployed for development and wider testing purposes without going through the App Store.

megalodon 10y ago

This write-up by CitizenLab [1] describes the Trident iOS exploit chain. Excerpt: CVE-2016-4657 [2]: Visiting a maliciously crafted website may lead to arbitrary code execution CVE-2016-4655 [3]: An application may be able to disclose kernel memory CVE-2016-4656 [4]: An application may be able to execute arbitrary code with kernel privileges [1] https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ https://citizenlab.org/2016/08/million-dollar-dissident-ipho... [2] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4657 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4657 [3] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4655 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4655 [4] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4656 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4656

nneonneo 10y ago
None of these exploits have anything to do with accessing TCP services using a browser. The only exploit there having anything to do with Safari, CVE-2016-4657, is a WebKit memory corruption (per your [1]: "The stage1 employs a previously undocumented memory corruption vulnerability in WebKit to execute this code within the context of the Safari browser (CVE-2016-4657).").
- megalodon 10y ago
  You're right, of course. I realised my mistake after the delete link had disappeared. My bad!