6 ms·

Interesting that the writers of this article are a company that sells a library to help developers detect their app running on jailbroken devices. https://blog.

Interesting that the writers of this article are a company that sells a library to help developers detect their app running on jailbroken devices. https://blog.trailofbits.com/2017/10/12/ios-jailbreak-detection-toolkit-now-available/ https://blog.trailofbits.com/2017/10/12/ios-jailbreak-detect...

saagarjha 7y ago
Ah, yes, the bane of Apple engineers everywhere.
krackers 7y ago
>library to help developers detect their app running on jailbroken devices How does this work? I thought iOS apps are sandboxed to an extent where it shouldn't be possible to snoop around to determine which processes are running and such.
- nerdbaggy 7y ago
  Couldn’t tell you, I know as much as that article says. But I’m guessing that’s part of their secret sauce
  - saagarjha 7y ago
    I'm sure it's some combination of checking for files that shouldn't be accessible or exist, searching your own address space for things that shouldn't be there, and verifying that kernel calls produce the results that they should.
- js2 7y ago
  A jailbroken device allows apps to do things that a non-jailbroken device does not. I maintain my company's in-house mobile app crash reporting system and I had to remove jailbreak checks from our iOS SDK. It turned out that some of the checks were causing crashes themselves due to buggy anti-jailbreak-detection code some jailbroken devices had in place. e.g. checking whether a file could be accessed that normally iOS disallows would end up causing a crash instead of just a permission error. Instead, I just do some basic server-side detection. Basically, looking for libraries loaded into the app (e.g. cydia) that are only present on jailbroken devices. Some jailbreaks don't even try to hide their presence. I don't know what iVerify does. I hadn't heard of it before. I'm curious how it avoids crashes though... perhaps it avoids invoking any dynamic system calls.
  - baroffoos 7y ago
    The proper way of doing things should be that an app controls access to jailbreak features. By default nothing gets them and you can whitelist the ones which need it. I'm not sure if anything like this exists for ios but it should.
    - saagarjha 7y ago
      Depending on how much access you have, it's always possible for jailbreaks to hide their presence from applications (which are running at a lower privilege level). There are a couple of "jailbreak hider" implementations out there.
  - Bnshsysjab 7y ago
    Out of interest, why do you care if your users run your application on a jailbroken device? It’s been a question I’ve had for a while..
    - benbristow 7y ago
      Same reason as why rooted Android devices get blocked by certain applications. Security for the user's sake. Usually it's financial applications (banking etc.) and stuff with sensitive user information.
      - yjftsjthsd-h 7y ago
        As an Android user, this is super annoying: I rooted the device because I want to control it. Now some stupid app comes along and claims that, for my own protection (supposedly), they're going to break for me. It's insulting, really.
    - js2 7y ago
      We don’t care but when a crash occurs we collect diagnostic data that we think will help us narrow down the source of the crash. Sometimes a crash happens only on jailbroken devices in which case we usually don’t spend time on it.
- dguido 7y ago
  We discovered/developed a suite of side channels that let us indirectly read iOS system state from inside the sandbox. There are many different checks across unknown deviations, known jailbreak files and utilities, and runtime behaviors that help us narrow down whether your phone has been modified. It's not perfect, but it's the best you can do from within the Apple App sandbox.
  - stevekablink 7y ago
    If they used a language like Rust instead of Swift, iOS would be much more immune to these sorts of attack. There would be no side channels.
- Lt_Riza_Hawkeye 7y ago
  I assume you make a new mach-o file that hasn't been signed by apple and try to exec into it. If it runs, definitely jailbroken. Obviously a jailbroken phone could load a kernel module that detects this and stops it from running in this specific case, leading to a cat and mouse game between jailbreak developers and these apps. iBooks tried this once.
thejosh 7y ago
Makes sense given how they try and spin this is only good for pirates (and researchers), because they would be the only ones who would like a jailbroken device.
- baroffoos 7y ago
  A decade of corporate brainwashing has convinced people that only criminals want to control the device they own.
  - cbluth 7y ago
    Most people don't own, they use payment plans
    - saagarjha 7y ago
      From a technical perspective, both users have (or lack) equal access to their hardware. So the actual method of ownership isn't really relevant.
    - 14 7y ago
      And if a person loses the phone one month into their payment plan they still have to pay for the entire price of the phone. So you take ownership the moment you make an agreement with the company to make payments.
      - baroffoos 7y ago
        Payment plans seem like absolute insanity to me. Everyone I know on one is paying $100+ AUD per month perpetually since as soon as they have paid it off they get a new phone. I have found that it is insanely cheap to just buy last years phone second hand. I picked up a pixel 2 recently for $300 AUD when it was about $1000 the year before.
        sverhagen 7y ago
        To everyone their own. I very much respect your approach. But when I'm upgrading I don't want last year's model. My phone is the single most used "possession" in my life and after using one for two years, I like to treat myself.
tptacek 7y ago
Trail of Bits sells a jailbreak detection app the same way Ikea sells Swedish Meatballs. It's good jailbreak detection, but it's hardly what Trail is about.
- dguido 7y ago
  lol that's a great analogy! Yes, this is a small project for roughly one person at our company of 50. It's something we felt like we could contribute so we had fun with it. We already invested all the time elsewhere to master iOS. It's one of those 30 minutes + 15 years experience things.
SomeOldThrow 7y ago
Interesting that Apple forces you to use your device on their terms :)
- hi5eyes 7y ago
  since the release of ios 13 it has had multiple updates :)

saagarjha 7y ago

Ah, yes, the bane of Apple engineers everywhere.

krackers 7y ago

>library to help developers detect their app running on jailbroken devices How does this work? I thought iOS apps are sandboxed to an extent where it shouldn't be possible to snoop around to determine which processes are running and such.

nerdbaggy 7y ago
Couldn’t tell you, I know as much as that article says. But I’m guessing that’s part of their secret sauce
- saagarjha 7y ago
  I'm sure it's some combination of checking for files that shouldn't be accessible or exist, searching your own address space for things that shouldn't be there, and verifying that kernel calls produce the results that they should.
js2 7y ago
A jailbroken device allows apps to do things that a non-jailbroken device does not. I maintain my company's in-house mobile app crash reporting system and I had to remove jailbreak checks from our iOS SDK. It turned out that some of the checks were causing crashes themselves due to buggy anti-jailbreak-detection code some jailbroken devices had in place. e.g. checking whether a file could be accessed that normally iOS disallows would end up causing a crash instead of just a permission error. Instead, I just do some basic server-side detection. Basically, looking for libraries loaded into the app (e.g. cydia) that are only present on jailbroken devices. Some jailbreaks don't even try to hide their presence. I don't know what iVerify does. I hadn't heard of it before. I'm curious how it avoids crashes though... perhaps it avoids invoking any dynamic system calls.
- baroffoos 7y ago
  The proper way of doing things should be that an app controls access to jailbreak features. By default nothing gets them and you can whitelist the ones which need it. I'm not sure if anything like this exists for ios but it should.
  - saagarjha 7y ago
    Depending on how much access you have, it's always possible for jailbreaks to hide their presence from applications (which are running at a lower privilege level). There are a couple of "jailbreak hider" implementations out there.
- Bnshsysjab 7y ago
  Out of interest, why do you care if your users run your application on a jailbroken device? It’s been a question I’ve had for a while..
  - benbristow 7y ago
    Same reason as why rooted Android devices get blocked by certain applications. Security for the user's sake. Usually it's financial applications (banking etc.) and stuff with sensitive user information.
    - yjftsjthsd-h 7y ago
      As an Android user, this is super annoying: I rooted the device because I want to control it. Now some stupid app comes along and claims that, for my own protection (supposedly), they're going to break for me. It's insulting, really.
  - js2 7y ago
    We don’t care but when a crash occurs we collect diagnostic data that we think will help us narrow down the source of the crash. Sometimes a crash happens only on jailbroken devices in which case we usually don’t spend time on it.
dguido 7y ago
We discovered/developed a suite of side channels that let us indirectly read iOS system state from inside the sandbox. There are many different checks across unknown deviations, known jailbreak files and utilities, and runtime behaviors that help us narrow down whether your phone has been modified. It's not perfect, but it's the best you can do from within the Apple App sandbox.
- stevekablink 7y ago
  If they used a language like Rust instead of Swift, iOS would be much more immune to these sorts of attack. There would be no side channels.
Lt_Riza_Hawkeye 7y ago
I assume you make a new mach-o file that hasn't been signed by apple and try to exec into it. If it runs, definitely jailbroken. Obviously a jailbroken phone could load a kernel module that detects this and stops it from running in this specific case, leading to a cat and mouse game between jailbreak developers and these apps. iBooks tried this once.

thejosh 7y ago

Makes sense given how they try and spin this is only good for pirates (and researchers), because they would be the only ones who would like a jailbroken device.

baroffoos 7y ago
A decade of corporate brainwashing has convinced people that only criminals want to control the device they own.
- cbluth 7y ago
  Most people don't own, they use payment plans
  - saagarjha 7y ago
    From a technical perspective, both users have (or lack) equal access to their hardware. So the actual method of ownership isn't really relevant.
  - 14 7y ago
    And if a person loses the phone one month into their payment plan they still have to pay for the entire price of the phone. So you take ownership the moment you make an agreement with the company to make payments.
    - baroffoos 7y ago
      Payment plans seem like absolute insanity to me. Everyone I know on one is paying $100+ AUD per month perpetually since as soon as they have paid it off they get a new phone. I have found that it is insanely cheap to just buy last years phone second hand. I picked up a pixel 2 recently for $300 AUD when it was about $1000 the year before.
      - sverhagen 7y ago
        To everyone their own. I very much respect your approach. But when I'm upgrading I don't want last year's model. My phone is the single most used "possession" in my life and after using one for two years, I like to treat myself.

tptacek 7y ago

Trail of Bits sells a jailbreak detection app the same way Ikea sells Swedish Meatballs. It's good jailbreak detection, but it's hardly what Trail is about.

dguido 7y ago
lol that's a great analogy! Yes, this is a small project for roughly one person at our company of 50. It's something we felt like we could contribute so we had fun with it. We already invested all the time elsewhere to master iOS. It's one of those 30 minutes + 15 years experience things.

SomeOldThrow 7y ago

Interesting that Apple forces you to use your device on their terms :)

hi5eyes 7y ago
since the release of ios 13 it has had multiple updates :)