15 ms·
Developer of Checkm8 explains why iDevice jailbreak exploit is a game changer
- MuffinFlavored 7y ago> The exploit allows only tethered jailbreaks, meaning it lacks persistence. The exploit must be run each time an iDevice boots. Could it be made to persist? > Checkm8 doesn't bypass the protections offered by the Secure Enclave and Touch ID. Could it be made to bypass the Secure Enclave?
- chx 7y ago> Could it be made to persist? Unlikely and that'd be something Apple can patch at their leisure. > Could it be made to bypass the Secure Enclave? That's not how this works. The Secure Enclave generates and stores asymmetric encryption keys and exposes an interface to perform various operations with these keys. Retrieving the keys is not possible. You'd need a separate vulnerability in Secure Enclave. Once you found a Secure Enclave exploit you need to run it, yes and iOS does not want you to run it yes, but let's face it: anyone having the mastery to break the Secure Enclave is more than likely to have an entire stash of iOS zerodays...
- baybal2 7y ago> Could it be made to bypass the Secure Enclave? Well, drilling each individual chip is not economical, but doable. Usually it only meant to get something out, not in.
- Peckingjay 7y agoWith further exploits, possibly, but not with Checkm8 alone.
- phs318u 7y agoThe lack of persistence could be worked around by a small enough device disguised as a phone charger. A sufficiently motivated actor could use a human asset to plant/replace such chargers at a target’s home/work.
- jackcodes 7y agoIt’d surprise me if you couldn’t embed the necessary hardware required to run this inside a USB cable.
- mtthwd 7y agoThe exploit requires the device to be put into DFU mode first and can’t be triggered by connecting a cable alone. From the article: You have to have a cable connected to your device and put your device into DFU mode, and that requires you to hold buttons for a couple seconds in a correct way
- jsjohnst 7y agoThe exploit doesn’t work just by powering on with a hacked USB device, you have to boot in DFU mode, which requires holding a specific combination of buttons as it’s powered on. The article covers this.
- matwood 7y agoYou have to put the phone into DFU mode. Yes, this is a serious flaw, but in the last 24h the overreactions have already become the stuff of legends.
- cesarb 7y ago> Could it be made to persist? I don't think persistence is necessary. How often do people actually power off their smartphone? What most people think of as the "power button" only locks the screen (and puts the CPU into a "suspend" state to save power). Most people would have an "uptime" of months on their smartphone.
- derefr 7y agoIf you’re in the Beta program, you might get a new OS point-release installed (thus restarting your phone) every few days at some points (such as at new-major-release RC time.)
- reaperducer 7y agoHow often do people actually power off their smartphone? If you have iOS with auto-updates on, then it can reboot several times a year when Apple releases point updates. Or at least once a year when the new big version of iOS comes out. (Unless I'm mistaken and iPhones no longer reboot on point updates anymore, but I'm pretty sure they still do.)
- ryanlol 7y agoNot an issue because the attacker can disable these updates.
- habi 7y agoI know, N=1 but I turn off my phone completely every night.
- umanwizard 7y agoOut of curiosity, why?
- habi 7y ago- Part out of habit (since way before 'Do not disturb' mode), I want no disturbances when I sleep. - Because it saves battery/energy - No connected device in the bedroom (OK, I got a Kindle) - I (honestly) don't see any sense in having my phone run for ~7 hours while I'm asleep Why do you not turn off yours?
- factorized 7y agoSo it is necessary to know a device's PIN to apply this jailbreak? The article refers to Secure Enclave and how its protection cannot be bypassed, but it's unclear whether the PIN itself (and entering the DFU mode) is protected by the Secure Enclave.
- qeternity 7y agoThe PIN isn’t protected by the Secure Enclave. The PIN is what protects it. The SE protects cryptographic keys.
- morpheuskafka 7y agoThe PIN is not stored anywhere on the device. It is validated by the Secure Enclave but cannot be recalled. So this attack vector would need to involve flashing a malicious iOS clone that would boot normally and ask the user to enter their PIN/TouchID normally before activating malicious functions.
- jpxw 7y agoI’ve heard some people taking about using a raspberry pi zero or some other microcomputer to apply the exploit on boot, which sounds quite interesting. As someone who used to jailbreak back in the day, this news was really exciting. However looking at it in a mature way than I did back then, it’s also slightly worrying that a whole class of iOS devices have a severe and unpatchable security flaw.
- StavrosK 7y agoWhy is that? I've long been against Apple's stance of not allowing me access to the hardware I own, and this exploit seems the best of both worlds: If you want to make sure you're secure, just reboot the phone.
- mentat 7y agoIf you can access using this so can others when you cross borders, are stopped by police, have spying spouse, etc. Those are real and sometimes fatal threat models.
- deleted 7y ago[deleted]
- fullonrager 7y agoIf law enforcement did take your device, it would be useless if you have a passcode. Your data will still be encrypted.
- deleted 7y ago[deleted]
- gruez 7y agodepends on whether exploiting the bootrom allows you bypass the anti-hammering mechanism, or the "wipe data after 10 failed attempts" mechanism. A 6 digit passcode by itself is very easy to crack.
- pearjuice 7y agoThis is probably the same exploit used by three letter agencies to get into locked iDevices. It was known long before checkm8 became public.
- Xylakant 7y agoAfaics it doesn’t get you on locked devices. You can install custom firmware, but you’d still need the passcode or face/finger to unlock the actual content.
- vageli 7y ago> Afaics it doesn’t get you on locked devices. You can install custom firmware, but you’d still need the passcode or face/finger to unlock the actual content. It opens the door for an evil maid attack though. Replace firmware of target and once unlocked exfil the data. Since most people don't regularly turn off their phones in my experience, this attack would probably be successful against most users.
- matwood 7y agoLet's play out this scenario. Someone has to take your phone without you knowing and load some exfil software. This requires focused targeting of people who are not most users. Heads of state, journalists, etc... would just reboot the phone anytime it leaves their possession. Additionally, those users are who are likely targets would just get a newer phone. The reality is that right now, Checkm8 is great for jailbreakers of older phones and not much else.
- vageli 7y agoGood points. As a complete aside, your comment brought to mind one more group that might benefit: those in a relationship with someone whom they suspect is cheating on them.
- hcs 7y agoFor older phones it would, though there were maybe other exploits available as well? From the first page of the interview: > Before Apple introduced the Secure Enclave and Touch ID in 2013, you didn't have advanced security protections. So, for example, the [San Bernardino gun man's] phone that was famously unlocked [by the FBI]—the iPhone 5c— that didn't have Secure Enclave. So in that case, this vulnerability would allow you to very quickly get the PIN and get access to all the data. But for pretty much all current phones, from iPhone 6 to iPhone 8, there is a Secure Enclave that protects your data if you don't have the PIN.
- rwmj 7y agoIt seems if I read the article correctly that you can't use this to capture the PIN and further unlock the data, but I don't understand how Apple can make the phone secure against that (that is assuming I have understood the article).
- ethbro 7y agoIsolated co-processors and memory.
- oh_sigh 7y agoIf the user secret key like a pin is going through iOS, to the secure enclave, you can still run a hacked iOS which reports the stolen pin back to some server.
- rficcaglia 7y agoTypically the os would only have access to the encrypted pin, then use special secure enclave instructions to compute inside the enclave (basically special encrypted memory inside the processor). Ie the plaintext pin would never leave the enclave, even when the os kernel is compromised If you had the chip in a lab you could do sidechannel physical attacks with lasers and liquid nitrogen, etc
- eternalny1 7y ago> If you had the chip in a lab you could do sidechannel physical attacks with lasers and liquid nitrogen Wow, what do you do for a living if I might ask?
- deleted 7y ago[deleted]
- hcs 7y agoI think oh_sigh means capturing it when it is entered?
- shasheene 7y agoThis is great news. After a decade of stagnation [1], an exploit that in theory allows Linux (and Android) to be ported to iPhone, iPads, Apple Watches, and I believe, Apple TV. [1] https://en.wikipedia.org/wiki/OpeniBoot https://en.wikipedia.org/wiki/OpeniBoot
- rwmj 7y agoWhy wouldn't you just buy a rootable Android device in the first place? Cheaper, better phones and far less hassle to install your own OS on.
- emilfihlman 7y agoWhy wouldn't you want to run doom/linux on all the devices?
- rvz 7y agoPerhaps you wouldn't need to buy another separate Android device, since a iPhone dual-booting Android could make it the best supported Android device since the Pixel.
- BubRoss 7y agoNothing comes close to apple's ARM CPUs.
- cromwellian 7y agoMost of the performance of which is irrelevent, because the apps have to run on the lowest common denominator iPhone. This is not like Desktop PCs where a game might run at less than 60fps at a certain monitor resolution, iPhone software is more like the console market, so it's like saying you have a new PS4 model with 2x the speed of last years model. You're not likely going to notice the difference except at the edges, like launching apps are slightly faster. Apple's fan base, prior to the A6, used to be 'specs don't mstter', but once Apple got the lead in CPU speed, now specs matter. I think for most people the former is probably true. A faster phone doesn't make your Facebook, Snapchat, iMessage, Instagram, etc experience much better and lets be honest, people are spending the majority of time in those apps.
- orev 7y agoWhile this is great for the concept of jailbreaking, in practice I think it will be mostly academic. The devices this supports are already old, which doesn’t give much excitement to the process. The ecosystem of libraries, apps, stores, etc. around jailbreaking is in a dismal state, if it really even exists anymore. I really don’t expect a thriving marketplace to spring up again like we had in the old days. I do think it will be very useful for people doing security research, as it will allow them to access the full running images of supported devices. EDIT: Since people seem to be wildly missing my point, I clearly need to spell it out: The community and the ecosystem is what made jailbreaking great, and while this very cool work done, this isn't going to usher in a new golden age of jailbreaking because the community and ecosystem isn't there.
- MiroF 7y agoCalling 4S through X “old” is disingenuous. Your comment made me reread the article because I thought I had misunderstood.
- orev 7y agoThe "X" is two years old. That doesn't mean it's useless, but it does mean that the news doesn't carry the same weight as if it was the iPhone 11 Pro that was hacked.
- MiroF 7y agoThe vast majority of iPhones in circulation are the X or below. So, stated otherwise: this carries the same weight as saying about 90% (anecdotal estimate) of iPhones in circulation are jailbreakable
- givinguflac 7y agoiPhone X is still very capable and not at all old. Is it the newest? No, but saying a two year old device is useless is disingenuous.
- 7y ago
- clamprecht 7y agoPotential business opportunity - iPhone "virus scanner" device or service?
- duiker101 7y agoCan't wait for the bloatware iOS antiviruses!
- herf 7y agoSo somebody could make a battery case that also jailbreaks your phone (if you trigger DFU mode)?
- fullonrager 7y agoYes, I have also seen discussion of dongles being made to jailbreak your iPhone. The Nintendo Switch has a bootrom exploit and a dongle to exploit it is available.
- arminiusreturns 7y agoThe right to repair must include the right to root.
- all2 7y ago(Devil's advocate) why?
- dev_dull 7y agoNo way. The vast majority of us want phones that are totally impregnable. I want a phone that not even Apple can access, let alone Steve down at the repair shop. I’m normally all about right-to-repair, but with my phone I want privacy and security.
- guipsp 7y agoThe way androids do it is to wipe the device on root, which sounds reasonable
- saurik 7y agoSince you also want protection from Apple, you actually don't disagree: right now, Apple can put your phone in DFU mode and "upgrade" its software to a new build which gives them not just root access (which isn't terribly useful these days) but complete control over the kernel. (They still can't steal your data unless you help, due to disk encryption, but that's an unrelated topic.) I want a phone where Apple can't do that; but I mean, someone has to be able to do that, as otherwise the software on the phone can't be upgraded. So I want the person in control of that to be me, the owner. If I so choose, I can trust Apple's software. Or I can choose to not trust Apple's software and trust software from you. This concept of software trust eventually comes down to a root certificate (just as it already does), which should be controlled by the same secure enclave as the disk encryption (so the software itself can't alter my trust roots in case of an exploit). There: not only easy to be equivalent to what you have, not only able to give people like me actual control, but more secure than the status quo (as Apple can be locked out), not less.
- draw_down 7y agoIt’s been a while since I used jailbreak on an iOS device, but I remember the “benefits” being pretty skimpy. “You can install anything you want”, sure, except at least back then there wasn’t much compelling about that. And the whole thing is too much of a hassle.
- Ecco 7y agoI’m wondering about the economics of this release. I don’t know if Apple has any bug bounty program and whether it would apply here, but I’m pretty sure someone would have paid a lot of money for this. Hence my question: why make it public? What’s the backstory?
- matwood 7y agoSince it’s already fixed in the Xs and newer iPhones, I’m not sure Apple would have considered it a new exploit worthy of a payout.
- bootlooped 7y agoCellebrite might pay for it. Unless they already knew about it.
- tinus_hn 7y agoIt doesn’t really provide anything useful for Cellebrite and it only works on older devices.
- deleted 7y ago[deleted]
- bredren 7y agoiPhone X is barely 2 years old. It works on the vast majority of iPhones in use today. For those it allows complete data extraction except the Secure Enclave, correct? I suspect this would have been valuable.
- varenc 7y agoIf you have a passcode, all of your data is encrypted with keys stored in the Secure Enclave. So this alone won't let you dump the contents of a phone. (But it's a useful 1st step vulnerability to others)
- 7y ago
- ryanmarsh 7y agoI'm not really into the jail breaking / free software / right to repair side of this issue. I'm more interested in jailbreaking iOS devices because I believe they are incredible alternative to Raspberry Pi. If you consider how cheaply you can find a used iPhone 4S and what it's capable of, vs. a Raspberry Pi (as much as I love them) the engineering of the iPhone SOC really becomes stark in comparison. I'd rather be writing Swift code and loading it onto an iPhone. I believe an old iPhone could potentially make for a great DIY drone mainboard/controller.
- alperakgun 7y agoimho, a myriad of ios won't have the same Linux support which rasperry pi's enjoy.
- ryanmarsh 7y agoNot sure how that matters? iOS has great SDKs for device access and acceleration. Plenty of Unix software compiles on iOS too. Which packages would I want but could not compile for iOS?
- alperakgun 7y agoi think, ios, sdk and tools won't work for iphone 4,5,6 etc - so you won't have developer tool chain support and no way to update them due to non-OSS proprietary base.
- iamaelephant 7y agoSounds like you want an Android device.
- eddieh 7y agoI'd love to run Linux or NetBSD on the 3rd Gen Apple TV. I don't know if this would allow that. Last time I looked, the consensus was a hard no. There's also going to be tons of AirPort base stations that should be re-purposed, but as far as I know nobody has even bothered to find a jail break for AirPort devices. It would be nice just to be able to SSH into an AP.
- gumby 7y agoThe list of limitations of the jailbreak is itself interesting as it shows the benefits of defense at depth: even if you have this exploit you need physical access, Secure Enclave is still inaccessible etc. Compare to the "firewall" approach which is crunchy on the outside but nice and soft on the inside. Snowden showed the NSA intercepting unencrypted internal comms between google's and yahoo's respective datacenters. And our IoT devices are often exploited vectors. Interesting the Apple wouldn't even consider their own device boundary adequate. Compare to others who (used to? Still do?) keep, say, fingerprint data in the filesystem. Some people say code structure reflects organizational structure; I wonder if apple's own corporate structure (with internal inter-project secrecy, which I consider insane) lead in part to this approach: "I can't trust those other organizations writing system code to use the security features I put in so I'll consider them a kind of adversary too"
- neuland 7y agoJust curious, why do you think that inter-project secrecy within a company is a bad idea?
- markdown 7y agoFor the same reason that inter-agency secrecy contributed to the success (for the terrorists) of the 9/11 attacks.
- lostgame 7y agoYou mean the departments of government that planned and staged 9/11 didn’t communicate with the departments that would have to believe the cover story? I mean, that makes sense, why would they? I mean, why would a government stage an attack against its own people, anyways? Oh, right. Oil and war profits.
- enraged_camel 7y ago>>You mean the departments of government that planned and staged 9/11 Holy molly. We're spouting insane conspiracy theories on this site, now?
- punnerud 7y ago-If you are doing tracking in real time, you can see what's happening. If you want to, say, explore what happens when your phone goes to a website, you can't do that if you don't have a jailbreak because Apple doesn't give you the specific permissions that you need to see things happening at such a low level on your phone. How is this different than MITMproxy, Burp Suite, Charles combined with setting iPhone to proxy the traffic through your machine?
- tptacek 7y agoThose all depend on the phone software honoring proxy settings.
- eat 7y agoWell, to accomplish that with HTTPS traffic, you'd have to tell your device to accept (for example) Burp's CA certificate. Many applications (especially sensitive applications such as banking) nowadays use certificate pinning to verify the expected certificate and prevent this kind of MITM from happening. So you'd still need to do some sort of lower-level manipulation, such as manually hooking the certificate validation functions, to even be able to get this proxying to work. It's becoming increasingly difficult to really see what's going on without a jailbroken iPhone, or rooted Android device.
- pweezy 7y agoThe article makes repeated mentions of the lack of persistence (rebooting the phone removes the exploit), suggesting this makes it very little of a security threat. However, most people reboot their phone very rarely: the occasional software update a couple times a year; if the battery runs out (which people usually go to pains to avoid); or for some people, to try to fix a misbehaving phone. The exploit does require physical access to the phone for a few minutes. But in situations where that can happen, and the owner doesn't have the suspicion or knowledge to reboot, I think an exploit could easily run for one or several months. Paired with enough clever software modifications made possible by the jailbreak (like a lock screen that collects passcode input), a malicious instance of this could do plenty of damage.
- willis936 7y agoI think more practical concerns are cases of forced seizure by the government. The easier it is to access private data against someone’s will, the more often it will happen.
- GeekyBear 7y agoIf your device tells you that you are required to enter your passcode (instead of having biometric authentication available) at a time when you have not just rebooted the device yourself, that would be your clue that something unusual is going on. At which time you simply need to reboot the device yourself to clear anything made possible by this particular boot ROM bug.
- mantap 7y agoiOS requires users to enter their passcode every week so they don't forget it.
- sargun 7y agoIf apple knew about this exploit (given the patched the boot ROM on the newer phones), will iPhones that ship after a certain date have this fixed?