4 ms·

Is "jailbreak" equivalent to "total root privileges"? In other words, does the existence of a jailbreak like this also imply the same strategy could work for m

Is "jailbreak" equivalent to "total root privileges"? In other words, does the existence of a jailbreak like this also imply the same strategy could work for malware? Or is "jailbreak" here a more targeted exploit, to allow sideloading apps? The reason I'm curious is because Apple seems to have put lots of effort into their "secure enclave" and specialized hardware to avoid this type of situation. So I'm curious if this bypasses all that, or only part of it.

Wowfunhappy 6y ago
All Jailbreaks need full kernel access, but I don't believe any of them have ever gained access to the secure enclave, and most aren't even persistent after a reboot. Malware could probably use the same exploits, yes, but the exploits used for most Jailbreaks are pretty "noisy", and I have trouble imagining a situation where they could be used without the user's knowledge. It's certainly possible though.
- saagarjha 6y ago
  checkra1n has; the others have not. Jailbreaks are generally optimized for time-to-market and not discretion, but actual malware could certainly take the code and make it less likely to crash or do funny things that are easy to detect.
  - o-__-o 6y ago
    The su binary for android. Distributed on a mega.nz link and obfuscated. How large was the embedded botnet and what were the rare cases of good it was used for? Me deciding not to install supersu 10 years ago. I think it’s finally been replaced with an open sourced utility but I’ve already moved on
saagarjha 6y ago
> Is "jailbreak" equivalent to "total root privileges"? Somewhat. Apple designs multiple layers of security into their devices and jailbreaks these days compromise some set of these, and plus the security model of iOS is really "the user vs. everything else on the operating system" so the concept of "root" is much less important. You could consider it equivalent to "rooting”, however. > In other words, does the existence of a jailbreak like this also imply the same strategy could work for malware? Yes.

Wowfunhappy 6y ago

All Jailbreaks need full kernel access, but I don't believe any of them have ever gained access to the secure enclave, and most aren't even persistent after a reboot. Malware could probably use the same exploits, yes, but the exploits used for most Jailbreaks are pretty "noisy", and I have trouble imagining a situation where they could be used without the user's knowledge. It's certainly possible though.

saagarjha 6y ago
checkra1n has; the others have not. Jailbreaks are generally optimized for time-to-market and not discretion, but actual malware could certainly take the code and make it less likely to crash or do funny things that are easy to detect.
- o-__-o 6y ago
  The su binary for android. Distributed on a mega.nz link and obfuscated. How large was the embedded botnet and what were the rare cases of good it was used for? Me deciding not to install supersu 10 years ago. I think it’s finally been replaced with an open sourced utility but I’ve already moved on

saagarjha 6y ago

> Is "jailbreak" equivalent to "total root privileges"? Somewhat. Apple designs multiple layers of security into their devices and jailbreaks these days compromise some set of these, and plus the security model of iOS is really "the user vs. everything else on the operating system" so the concept of "root" is much less important. You could consider it equivalent to "rooting”, however. > In other words, does the existence of a jailbreak like this also imply the same strategy could work for malware? Yes.