7 ms·

I still remember geohot's miracle of his limera1n exploit, which was an unpatchable iBoot exploit on iPhone 4. And now we have its successor - axi0mX's ‏checkm8

I still remember geohot's miracle of his limera1n exploit, which was an unpatchable iBoot exploit on iPhone 4. And now we have its successor - axi0mX's ‏checkm8, still an iBoot exploit, still unpatchable. It seems to be another golden age for iOS jailbreaking has came! Also, just like limera1n, it requires total physical control over the device to run the exploit. A complete, untethered jailbreak still requires additional kernel/userspace exploits, so I don't see it as a major security problem, but it does make the job of an evil maid a bit easier. Just for nostalgia, here's the original release text of limera1n. > limera1n, 6 months in the making > iPhone 3GS, iPod Touch (3rd generation), iPad, iPhone 4, iPod Touch (4th generation) > 4.0-4.1 and beyond+++ > limera1n is unpatchable > untethered thanks to jailbreakme star comex > brought to you by geohot > hacktivates > Mac coming in 7 years > donations keep support alive > zero pictures of my face

mstg 7y ago
iBoot and BootROM is different. iBoot is software (patchable) while BootROM is read-only. Otherwise, agree! It's really a big achievement.
- roblabla 7y ago
  I'm very confused. On one hand, the tweet claims to have a bootrom exploit. On the other hand, the fifth tweet in the chain talks about an iBoot vulnerability that got patched in ios12 beta[1]. Maybe the vulnerable codepath has some code sharing between iBoot and SecureROM? [1]: https://twitter.com/axi0mX/status/1177544539046703104 https://twitter.com/axi0mX/status/1177544539046703104
  - mstg 7y ago
    If I've understood this correctly, it was an iBoot vulnerability enabling the exploitation of the BootROM vulnerability untethered (without connecting to a computer again). Since the iBoot vulnerability is patched, the phone has to be connected to a computer every time to boot if there has been any tinkering (custom FW or any change in boot sequence). So prepatch you could exploit the BootROM vulnerability untethered with the iBoot vulnerability, but postpatch have to connect to a computer to boot every time if you have done any tinkering which is why it is currently only adviced for security researchers. Tinkering with the BootROM also leads to invalidations of APTickets (so a future restore may be impossible without special gear).
  - comex 7y ago
    > Maybe the vulnerable codepath has some code sharing between iBoot and SecureROM? It does.
    - mstg 7y ago
      Comex himself has spoken! It turns out I definitely didn't understand it correctly. Thanks for the clarification!
    - bumblebritches5 7y ago
      Do you have iBoot's source code from the leak a while back?
      - null_auspices 7y ago
        https://github.com/PUNISHMENT-POSSE/Apple-iOS-9-Source-Code https://github.com/PUNISHMENT-POSSE/Apple-iOS-9-Source-Code
jorvi 7y ago
First of all, congrats to Axi0mX! It must have been quite the exploiting effort. > It seems to be another golden age for iOS jailbreaking has came! There is much, much less reason to jailbreak these days than in the iPhone 1 - 5 days. Unlocked iPhones are easy to get. Apple has copied a tremendous amount of features, and with iOS 13 having both dark mode and a fixed volume HUD even more reasons (Noctis / Eclipse and SmartVolumeControl2) are gone. And those, along with CallBarXS (call bar instead of fullscreen calls) and Jellyfish (weather on your lockscreen) are by far the most popular tweaks. I suspect at least the fullscreen calling will be redone in iOS 14. Theming and game emulators will probably never come to the App Store, but those are even more niche. Terminal emulators and Python environments are already in the store. That leaves.. SSHing into your phone I guess, which is mostly a gimmick. That's not to say the wild wild west wasn't fun back then. I remember both the Yellowsn0w and Redsn0w periods of jailbreaking vividly. Icy (a Cydia alternative) dying, being revived, and dying again. Down the nostalgia rabbit hole we go..
- Wowfunhappy 7y ago
  There a plethora of reasons I still Jailbreak my phone, but some off the top of my head: • Put an extra column of icons per page on my homescreen. • Rename apps on the homescreen, and change their icons. • Enable the iPad's "grid" app switcher on my phone. • Remove the stupid app bar in Messages. • Hide various UI elements around the OS and in apps, to make everything cleaner. (Cool note: you can use PermaFlex to hide nearly any arbitrary element.) • Downgrade apps that release updates I dislike. • Stop Apple News from creating "personalized" recommendations that would keep me in a filter bubble. • Play audio from Youtube videos (in Safari) while the screen is locked. • Install a Userscript that gets rid of AMP in Google search results. I realize a lot of these things are nitpicks—some maybe even personal eccentricities—but taken together they just make my phone a lot more pleasant to use. I would not buy an iPhone I could not Jailbreak, full stop.
  - josteink 7y ago
    > Play audio from Youtube videos (in Safari) while the screen is locked. You have a long good list of reasons, but this one is fixable by installing the YouTube app and paying for premium.
ValentineC 7y ago
> It seems to be another golden age for iOS jailbreaking has came! It's sadly limited to the A11 (iPhone X) chips and everything before that.
- Wowfunhappy 7y ago
  That's pretty darn great compared to the current situation. Perhaps not quite a return to the redsn0w days, but a major boon all the same. A (large?) majority of the iPhones currently in circulation will soon be Jailbreakable—not just for one brief moment in time (as with iOS 12.4), but on every future version of iOS. I didn't think that was ever going to happen again.
- Shank 7y ago
  As an A12 owner, I'm really happy my device is now reasonably more secure if taken into a government back room during customs or via an evil maid attack. Different perspective I suppose.
  - mlevental 7y ago
    willfully sacrificing freedom for security writ small.
    - austhrow743 7y ago
      Intentionally buying and using a secure device isn't what that phrase is about. Benjamin Franklin wasnt arguing against safes.
      - mlevental 7y ago
        how is this like a safe? you possess the keys to a safe you own. you do not possess the keys to iphones with a12 chips in the sense that this exploit delivers.
        oarsinsync 7y ago
deleted 7y ago
[deleted]

mstg 7y ago

iBoot and BootROM is different. iBoot is software (patchable) while BootROM is read-only. Otherwise, agree! It's really a big achievement.

roblabla 7y ago
I'm very confused. On one hand, the tweet claims to have a bootrom exploit. On the other hand, the fifth tweet in the chain talks about an iBoot vulnerability that got patched in ios12 beta[1]. Maybe the vulnerable codepath has some code sharing between iBoot and SecureROM? [1]: https://twitter.com/axi0mX/status/1177544539046703104 https://twitter.com/axi0mX/status/1177544539046703104
- mstg 7y ago
  If I've understood this correctly, it was an iBoot vulnerability enabling the exploitation of the BootROM vulnerability untethered (without connecting to a computer again). Since the iBoot vulnerability is patched, the phone has to be connected to a computer every time to boot if there has been any tinkering (custom FW or any change in boot sequence). So prepatch you could exploit the BootROM vulnerability untethered with the iBoot vulnerability, but postpatch have to connect to a computer to boot every time if you have done any tinkering which is why it is currently only adviced for security researchers. Tinkering with the BootROM also leads to invalidations of APTickets (so a future restore may be impossible without special gear).
- comex 7y ago
  > Maybe the vulnerable codepath has some code sharing between iBoot and SecureROM? It does.
  - mstg 7y ago
    Comex himself has spoken! It turns out I definitely didn't understand it correctly. Thanks for the clarification!
  - bumblebritches5 7y ago
    Do you have iBoot's source code from the leak a while back?
    - null_auspices 7y ago
      https://github.com/PUNISHMENT-POSSE/Apple-iOS-9-Source-Code https://github.com/PUNISHMENT-POSSE/Apple-iOS-9-Source-Code

jorvi 7y ago

First of all, congrats to Axi0mX! It must have been quite the exploiting effort. > It seems to be another golden age for iOS jailbreaking has came! There is much, much less reason to jailbreak these days than in the iPhone 1 - 5 days. Unlocked iPhones are easy to get. Apple has copied a tremendous amount of features, and with iOS 13 having both dark mode and a fixed volume HUD even more reasons (Noctis / Eclipse and SmartVolumeControl2) are gone. And those, along with CallBarXS (call bar instead of fullscreen calls) and Jellyfish (weather on your lockscreen) are by far the most popular tweaks. I suspect at least the fullscreen calling will be redone in iOS 14. Theming and game emulators will probably never come to the App Store, but those are even more niche. Terminal emulators and Python environments are already in the store. That leaves.. SSHing into your phone I guess, which is mostly a gimmick. That's not to say the wild wild west wasn't fun back then. I remember both the Yellowsn0w and Redsn0w periods of jailbreaking vividly. Icy (a Cydia alternative) dying, being revived, and dying again. Down the nostalgia rabbit hole we go..

Wowfunhappy 7y ago
There a plethora of reasons I still Jailbreak my phone, but some off the top of my head: • Put an extra column of icons per page on my homescreen. • Rename apps on the homescreen, and change their icons. • Enable the iPad's "grid" app switcher on my phone. • Remove the stupid app bar in Messages. • Hide various UI elements around the OS and in apps, to make everything cleaner. (Cool note: you can use PermaFlex to hide nearly any arbitrary element.) • Downgrade apps that release updates I dislike. • Stop Apple News from creating "personalized" recommendations that would keep me in a filter bubble. • Play audio from Youtube videos (in Safari) while the screen is locked. • Install a Userscript that gets rid of AMP in Google search results. I realize a lot of these things are nitpicks—some maybe even personal eccentricities—but taken together they just make my phone a lot more pleasant to use. I would not buy an iPhone I could not Jailbreak, full stop.
- josteink 7y ago
  > Play audio from Youtube videos (in Safari) while the screen is locked. You have a long good list of reasons, but this one is fixable by installing the YouTube app and paying for premium.

ValentineC 7y ago

> It seems to be another golden age for iOS jailbreaking has came! It's sadly limited to the A11 (iPhone X) chips and everything before that.

Wowfunhappy 7y ago
That's pretty darn great compared to the current situation. Perhaps not quite a return to the redsn0w days, but a major boon all the same. A (large?) majority of the iPhones currently in circulation will soon be Jailbreakable—not just for one brief moment in time (as with iOS 12.4), but on every future version of iOS. I didn't think that was ever going to happen again.
Shank 7y ago
As an A12 owner, I'm really happy my device is now reasonably more secure if taken into a government back room during customs or via an evil maid attack. Different perspective I suppose.
- mlevental 7y ago
  willfully sacrificing freedom for security writ small.
  - austhrow743 7y ago
    Intentionally buying and using a secure device isn't what that phrase is about. Benjamin Franklin wasnt arguing against safes.
    - mlevental 7y ago
      how is this like a safe? you possess the keys to a safe you own. you do not possess the keys to iphones with a12 chips in the sense that this exploit delivers.
      - oarsinsync 7y ago

deleted 7y ago

[deleted]