12 ms·
Tethered Jailbreaks Are Back
- nerdbaggy 7y agoInteresting that the writers of this article are a company that sells a library to help developers detect their app running on jailbroken devices. https://blog.trailofbits.com/2017/10/12/ios-jailbreak-detection-toolkit-now-available/ https://blog.trailofbits.com/2017/10/12/ios-jailbreak-detect...
- saagarjha 7y agoAh, yes, the bane of Apple engineers everywhere.
- krackers 7y ago>library to help developers detect their app running on jailbroken devices How does this work? I thought iOS apps are sandboxed to an extent where it shouldn't be possible to snoop around to determine which processes are running and such.
- nerdbaggy 7y agoCouldn’t tell you, I know as much as that article says. But I’m guessing that’s part of their secret sauce
- saagarjha 7y agoI'm sure it's some combination of checking for files that shouldn't be accessible or exist, searching your own address space for things that shouldn't be there, and verifying that kernel calls produce the results that they should.
- js2 7y agoA jailbroken device allows apps to do things that a non-jailbroken device does not. I maintain my company's in-house mobile app crash reporting system and I had to remove jailbreak checks from our iOS SDK. It turned out that some of the checks were causing crashes themselves due to buggy anti-jailbreak-detection code some jailbroken devices had in place. e.g. checking whether a file could be accessed that normally iOS disallows would end up causing a crash instead of just a permission error. Instead, I just do some basic server-side detection. Basically, looking for libraries loaded into the app (e.g. cydia) that are only present on jailbroken devices. Some jailbreaks don't even try to hide their presence. I don't know what iVerify does. I hadn't heard of it before. I'm curious how it avoids crashes though... perhaps it avoids invoking any dynamic system calls.
- baroffoos 7y agoThe proper way of doing things should be that an app controls access to jailbreak features. By default nothing gets them and you can whitelist the ones which need it. I'm not sure if anything like this exists for ios but it should.
- saagarjha 7y agoDepending on how much access you have, it's always possible for jailbreaks to hide their presence from applications (which are running at a lower privilege level). There are a couple of "jailbreak hider" implementations out there.
- Bnshsysjab 7y agoOut of interest, why do you care if your users run your application on a jailbroken device? It’s been a question I’ve had for a while..
- benbristow 7y agoSame reason as why rooted Android devices get blocked by certain applications. Security for the user's sake. Usually it's financial applications (banking etc.) and stuff with sensitive user information.
- yjftsjthsd-h 7y agoAs an Android user, this is super annoying: I rooted the device because I want to control it. Now some stupid app comes along and claims that, for my own protection (supposedly), they're going to break for me. It's insulting, really.
- js2 7y agoWe don’t care but when a crash occurs we collect diagnostic data that we think will help us narrow down the source of the crash. Sometimes a crash happens only on jailbroken devices in which case we usually don’t spend time on it.
- dguido 7y agoWe discovered/developed a suite of side channels that let us indirectly read iOS system state from inside the sandbox. There are many different checks across unknown deviations, known jailbreak files and utilities, and runtime behaviors that help us narrow down whether your phone has been modified. It's not perfect, but it's the best you can do from within the Apple App sandbox.
- stevekablink 7y agoIf they used a language like Rust instead of Swift, iOS would be much more immune to these sorts of attack. There would be no side channels.
- Lt_Riza_Hawkeye 7y agoI assume you make a new mach-o file that hasn't been signed by apple and try to exec into it. If it runs, definitely jailbroken. Obviously a jailbroken phone could load a kernel module that detects this and stops it from running in this specific case, leading to a cat and mouse game between jailbreak developers and these apps. iBooks tried this once.
- thejosh 7y agoMakes sense given how they try and spin this is only good for pirates (and researchers), because they would be the only ones who would like a jailbroken device.
- baroffoos 7y agoA decade of corporate brainwashing has convinced people that only criminals want to control the device they own.
- cbluth 7y agoMost people don't own, they use payment plans
- saagarjha 7y agoFrom a technical perspective, both users have (or lack) equal access to their hardware. So the actual method of ownership isn't really relevant.
- 14 7y agoAnd if a person loses the phone one month into their payment plan they still have to pay for the entire price of the phone. So you take ownership the moment you make an agreement with the company to make payments.
- baroffoos 7y agoPayment plans seem like absolute insanity to me. Everyone I know on one is paying $100+ AUD per month perpetually since as soon as they have paid it off they get a new phone. I have found that it is insanely cheap to just buy last years phone second hand. I picked up a pixel 2 recently for $300 AUD when it was about $1000 the year before.
- sverhagen 7y agoTo everyone their own. I very much respect your approach. But when I'm upgrading I don't want last year's model. My phone is the single most used "possession" in my life and after using one for two years, I like to treat myself.
- tptacek 7y agoTrail of Bits sells a jailbreak detection app the same way Ikea sells Swedish Meatballs. It's good jailbreak detection, but it's hardly what Trail is about.
- dguido 7y agolol that's a great analogy! Yes, this is a small project for roughly one person at our company of 50. It's something we felt like we could contribute so we had fun with it. We already invested all the time elsewhere to master iOS. It's one of those 30 minutes + 15 years experience things.
- SomeOldThrow 7y agoInteresting that Apple forces you to use your device on their terms :)
- hi5eyes 7y agosince the release of ios 13 it has had multiple updates :)
- HeWhoLurksLate 7y agoYay! I have fond memories of my friends (and eventually me, on the family iPad) jailbreaking our devices and doing stuff with them. A lot of the things I saw from jailbreaks were incorporated into later iOS updates- I'm curious (and excited!) to see what develops out of this wave.
- jimmaswell 7y agoWhat's the point now that we have Android?
- lostgame 7y agoGarageBand. iMovie. Both of which can have their projects opened in Logic Pro or Final Cut, an irreplaceable workflow for which there is no Android equivalent. Audio Bus. Not Google. For me, ARkit is huge for some hobby projects.
- anon9001 7y agoIf Apple would sell me one of their dev phones that gives me root, I'd switch from Android in a second. I don't understand why this is such a big deal for them. They could even charge more for it, or make it so tech support is excluded from those phones, or whatever they need to do make money. They'd bring all the hackers back to their platform. Do you realize how much effort is spent on Android mods? Can you imagine if those people were busy making iPhones do more thing? Because that's what'd happen if they'd sell me a rooted phone.
- lostgame 7y agoMeh, there’s a small but dedicated community for mods, but they can affect system stability and that’s not a compromise Apple wants to make. Not having root has never affected my almost ten year iOS dev career.
- ladberg 7y agoSo far, only iOS can run on iDevices, which means if you want to use Apple hardware you have to use iOS.
- CalChris 7y agoI jailbroke my old iPhones but that was in an earlier less featureful iOS era. I wonder what hackers will be able to provide such that I'd do it on an SE. Curious now as much as I am skeptical.
- jquery 7y agoAll I wanted is a mirrored CarPlay option with a cursor for people who use a joystick instead of a touchscreen. I know this exists in the jailbreaking community (minus the cursor).
- jasonhansel 7y agoHonestly, if there's a real security risk, I'm surprised Apple hasn't recalled the phones or offered to repair them. Unpatchable firmware flaws are (or should be) no different from hardware flaws in this respect.
- nerdbaggy 7y agoApple isn’t really known for doing recalls until they absolutely have to
- dylan604 7y ago"Take the number of 'iPhones' in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one." A modified version of the movie quote to fit the discussion
- giancarlostoro 7y ago"the movie quote" = Fight Club, since yes, there's people who have not seen that movie, but we don't talk about that.
- xvector 7y agoWhich makes sense too. If Apple was negligent in the security space and these flaws were common then I would be all for a recall. But Apple clearly has not been negligent in this space and they really have put forth best effort.
- wklauss 7y ago> if there's a real security risk There is, but it's not that great. You need physical access to the device and it won't be persistent (a reboot will clean it).
- dguido 7y agoIt certainly will _feel_ persistent if you're successfully attacked with this technique. If your iOS software is swapped out for a version with a backdoor, then the attacker will have collected your passwords and authentication tokens to services you use. If you reboot to clear the backdoor (and let's be honest: no one reboots their phones), then you won't also "clear" your attacker's memory of all your passwords.
- js2 7y agoPrior discussion: https://news.ycombinator.com/item?id=21099996 https://news.ycombinator.com/item?id=21099996
- rodgerd 7y agoThis will delight the one person in ten thousand who wants to jailbreak their own phone, and the border police in Australia (mandatory scans of phone required on demand), or China, or stalkerware retailers, or repair shops who like to rat around on customers' phones. Guess which will be the more common use?
- fourthark 7y agoReboot your phone if you know you have given it to someone you don't trust.
- rodgerd 7y agoThis is a persistent compromise. That will not help.
- tptacek 7y agoNo, it's exactly not that.
- Operyl 7y agoEven the title says "Tethered." It's far from persistent.
- skinnymuch 7y agoThe title says tethered
- heavyset_go 7y agoYou can already assume that states are sitting on exploits that they've found or bought, and that they can compel companies to provide some form of access via NSLs or secret courts.
- randyrand 7y agoonly more advanced states.
- ryeights 7y agoAre there potential disadvantages involved with “demotion” to enable JTAG? From what I understand the process is permanent (eFUSE?) but it seems like a fun thing to play around with
- ronsor 7y agoJailbreaking is software based and doesn't actually void your warranty. Demotion will.
- deleted 7y ago[deleted]
- dusted 7y agoOh, here's a biz idea: build exploit into device, then when you've got something better/stronger/faster to sell, you leak the exploit and let the press urge people to buy your latest.
- nallerooth 7y agoAs I see it, the effect of this is twofold. While it's bad for (at least some of) the iDevice users who carry sensitive data - it might also be just the thing that makes those users buy a new device. I guess that would be a "good" security issue in Apple's book. And no, I'm not implying that Apple has designed this security flaw in order to sell more devices.
- alecmg 7y ago> We strongly urge all journalists, activists, and politicians to upgrade to an iPhone that was released in the past two years with an A12 or higher CPU. This makes no sense. The data of these VIPs is not in (more) danger due to this new jailbreak appearing. It sounds like a cheap trick to make people buy new phones.
- gbuk2013 7y ago"checkm8 doesn't allow law enforcement to decrypt the phone, but it does allow them to rootkit it with 30 seconds of unattended access. Once it's unlocked by the user they'd get everything they need." That sounds like something more than a little worrying to the listed groups of people, no?
- yjftsjthsd-h 7y agoSo if the phone is out of your sight, reboot. And now you're clean again.
- anfilt 7y agoIf anything this should be a boon to users. It allows them fully to use their devices they own. Honestly, it is inexcusable that apple makes users have to hack their own devices. You should have the option similar to enabling or disabling secure boot on your PC.