4 ms·
> The exploit allows only tethered jailbreaks, meaning it lacks persistence. The exploit must be run each time an iDevice boots. Could it be made to persist?
by MuffinFlavored 7y ago
> The exploit allows only tethered jailbreaks, meaning it lacks persistence. The exploit must be run each time an iDevice boots.
Could it be made to persist?
> Checkm8 doesn't bypass the protections offered by the Secure Enclave and Touch ID.
Could it be made to bypass the Secure Enclave?
- chx 7y ago> Could it be made to persist? Unlikely and that'd be something Apple can patch at their leisure. > Could it be made to bypass the Secure Enclave? That's not how this works. The Secure Enclave generates and stores asymmetric encryption keys and exposes an interface to perform various operations with these keys. Retrieving the keys is not possible. You'd need a separate vulnerability in Secure Enclave. Once you found a Secure Enclave exploit you need to run it, yes and iOS does not want you to run it yes, but let's face it: anyone having the mastery to break the Secure Enclave is more than likely to have an entire stash of iOS zerodays...
- baybal2 7y ago> Could it be made to bypass the Secure Enclave? Well, drilling each individual chip is not economical, but doable. Usually it only meant to get something out, not in.
- Peckingjay 7y agoWith further exploits, possibly, but not with Checkm8 alone.
- phs318u 7y agoThe lack of persistence could be worked around by a small enough device disguised as a phone charger. A sufficiently motivated actor could use a human asset to plant/replace such chargers at a target’s home/work.
- jackcodes 7y agoIt’d surprise me if you couldn’t embed the necessary hardware required to run this inside a USB cable.
- mtthwd 7y agoThe exploit requires the device to be put into DFU mode first and can’t be triggered by connecting a cable alone. From the article: You have to have a cable connected to your device and put your device into DFU mode, and that requires you to hold buttons for a couple seconds in a correct way
- jsjohnst 7y agoThe exploit doesn’t work just by powering on with a hacked USB device, you have to boot in DFU mode, which requires holding a specific combination of buttons as it’s powered on. The article covers this.
- matwood 7y agoYou have to put the phone into DFU mode. Yes, this is a serious flaw, but in the last 24h the overreactions have already become the stuff of legends.
- cesarb 7y ago> Could it be made to persist? I don't think persistence is necessary. How often do people actually power off their smartphone? What most people think of as the "power button" only locks the screen (and puts the CPU into a "suspend" state to save power). Most people would have an "uptime" of months on their smartphone.
- derefr 7y agoIf you’re in the Beta program, you might get a new OS point-release installed (thus restarting your phone) every few days at some points (such as at new-major-release RC time.)
- reaperducer 7y agoHow often do people actually power off their smartphone? If you have iOS with auto-updates on, then it can reboot several times a year when Apple releases point updates. Or at least once a year when the new big version of iOS comes out. (Unless I'm mistaken and iPhones no longer reboot on point updates anymore, but I'm pretty sure they still do.)
- ryanlol 7y agoNot an issue because the attacker can disable these updates.
- habi 7y agoI know, N=1 but I turn off my phone completely every night.
- umanwizard 7y agoOut of curiosity, why?
- habi 7y ago- Part out of habit (since way before 'Do not disturb' mode), I want no disturbances when I sleep. - Because it saves battery/energy - No connected device in the bedroom (OK, I got a Kindle) - I (honestly) don't see any sense in having my phone run for ~7 hours while I'm asleep Why do you not turn off yours?