4 ms·

Root is to Android what jailbreak is to iOS, and the proof of concept[0] that was released is exactly that rooting tool. https://play.google.com/store/apps/det

by desdiv 10y ago

Root is to Android what jailbreak is to iOS, and the proof of concept[0] that was released is exactly that rooting tool. https://play.google.com/store/apps/details?id=org.iseclab.drammer https://play.google.com/store/apps/details?id=org.iseclab.dr...

ikeboy 10y ago
Except jailbreaks are historically much harder to find than root exploits. iOS 10 still has no public jailbreak. You can see this reflected in the going rates for vulnerabilities, respectively. A remote iOS jailbreak can net you a cool 1.5 million, while Android goes for $200,000.http://arstechnica.com/security/2016/09/1-5-million-bounty-for-iphone-exploits-is-sure-to-bolster-supply-of-0days/ http://arstechnica.com/security/2016/09/1-5-million-bounty-f...
- m_eiman 10y ago
  Is there any reason to suspect that the same technique wouldn't work to get root on iOS? Then there's the slight problem of rootless that makes it harder to do a permanent jailbreak, but getting root should be a pretty decent step along the way.
  - userbinator 10y ago
    "rootless" is no real obstacle, Rowhammer is almost an arbitrary memory modification exploit. All you need to do(!) is find and modify the appropriate bits, and you will have full control. With "sufficient" effort you should be able to get files in persistent storage modified too, and from there get a permanent jailbreak.
ocdtrekkie 10y ago
Unsurprisingly, Google has purged this app from the store.
- ikeboy 10y ago
  They allow quadrooter and stagefright testing apps. Why would this be different?
  - Natanael_L 10y ago
    Because the core of this testing app induces the flaw, while other apps merely detect the presence of their respective flaws. You don't get to trigger the actual exploit.
    - ikeboy 10y ago
      Is there any way to test for drammer without triggering it? The app doesn't actually root the phone, as far as I can tell.
nradov 10y ago
The Google Play store link is broken, probably removed due to ToS violation. Does anyone have an alternate link to download the apk?
- tinix 10y ago
  https://github.com/vusec/drammer https://github.com/vusec/drammer https://vvdveen.com/publications/drammer.pdf https://vvdveen.com/publications/drammer.pdf https://vvdveen.com/drammer/drammer.apk https://vvdveen.com/drammer/drammer.apk

by desdiv 10y ago

ikeboy 10y ago

Except jailbreaks are historically much harder to find than root exploits. iOS 10 still has no public jailbreak. You can see this reflected in the going rates for vulnerabilities, respectively. A remote iOS jailbreak can net you a cool 1.5 million, while Android goes for $200,000.http://arstechnica.com/security/2016/09/1-5-million-bounty-for-iphone-exploits-is-sure-to-bolster-supply-of-0days/ http://arstechnica.com/security/2016/09/1-5-million-bounty-f...

m_eiman 10y ago
Is there any reason to suspect that the same technique wouldn't work to get root on iOS? Then there's the slight problem of rootless that makes it harder to do a permanent jailbreak, but getting root should be a pretty decent step along the way.
- userbinator 10y ago
  "rootless" is no real obstacle, Rowhammer is almost an arbitrary memory modification exploit. All you need to do(!) is find and modify the appropriate bits, and you will have full control. With "sufficient" effort you should be able to get files in persistent storage modified too, and from there get a permanent jailbreak.

ocdtrekkie 10y ago

Unsurprisingly, Google has purged this app from the store.

ikeboy 10y ago
They allow quadrooter and stagefright testing apps. Why would this be different?
- Natanael_L 10y ago
  Because the core of this testing app induces the flaw, while other apps merely detect the presence of their respective flaws. You don't get to trigger the actual exploit.
  - ikeboy 10y ago
    Is there any way to test for drammer without triggering it? The app doesn't actually root the phone, as far as I can tell.

nradov 10y ago

The Google Play store link is broken, probably removed due to ToS violation. Does anyone have an alternate link to download the apk?

tinix 10y ago
https://github.com/vusec/drammer https://github.com/vusec/drammer https://vvdveen.com/publications/drammer.pdf https://vvdveen.com/publications/drammer.pdf https://vvdveen.com/drammer/drammer.apk https://vvdveen.com/drammer/drammer.apk