7 ms·
IPad 2 JailBreakMe (3.0) now available
- jlongster 15y agoIt doesn't work on my iPhone on 4.3.3 with that 4.10.01 baseband. The cydia icon comes up, but when the icon changes to "Installing..." it just disappears.
- deleted 15y ago[deleted]
- StavrosK 15y agoAfter all the trouble Apple went to to secure the boot loader, I expected this to be a really complicated procedure. I saw the Tweet today and I went on the site, clicked on "install" and Cydia started installing. I was blown away. How is this even possible? Did they find another userland exploit that allows you to write to the boot loader? I am very, very impressed.
- Swannie 15y agoFrom http://blog.iphone-dev.org/post/7295551750/jailbreakme-times-3 http://blog.iphone-dev.org/post/7295551750/jailbreakme-times... "Q: Do the holes discovered by @comex put my device at risk? A: Yes. We recommend installing PDF Patcher 2 in Cydia once you’re jailbroken to eliminate this risk (any firmware version)."
- StavrosK 15y agoI just saw that two minutes ago, so it is a userland exploit. That's fantastic, I can install Grooveshark now!
- JonnieCache 15y agoPDF really is the most dangerous file format around today. Did you know the PDF spec includes its own LISP-like language? As well as basically anything else you can imagine. It is surely impossible to write a secure, conformant PDF reader. If I ran any kind of super-sensitive organisation I'd include an outright ban on PDF renderers in my security policy. If anyone really needed to look at PDFs, I'd require them to be rendered down to TIFs or something on a "cleanroom" machine, preferably running some sort of locked-down linux build. This talk has all the shocking details: http://www.youtube.com/watch?v=54XYqsf4JEY http://www.youtube.com/watch?v=54XYqsf4JEY
- rakkhi 15y agoHow about the Mozilla project to do PDF in js? http://blog.mozilla.com/cjones/2011/07/03/pdf-js-first-milestone/ http://blog.mozilla.com/cjones/2011/07/03/pdf-js-first-miles...
- JonnieCache 15y agoThat one wins by not bothering to conform to the PDF spec at all. The spec is huge, and the insecurity comes from having to faithfully implement all its utterly insane features, like embedding flash files, executing javascript, rendering external assets, and so on. The challenge is to decide which subset of those features you want to deliberately ignore. Most of the esoteric ones are likely critical to obscure, in-house business applications created years ago by corporate coders lacking in sense. Adobe Reader obviously implements everything, and its the reference implementation, so it is installed in most businesses. Unfortunately, business is the area most in need of security. In summary: OMGWTFPDF!
- dublinclontarf 15y agoMeh, didn't work for me. iPad.
- bad_user 15y agoWhat iOS version?
- kristofferR 15y agoSure you're on 4.3.3 and not 4.3.2/4.3.1?
- dublinclontarf 15y agoi think its 4.3.2 Ive not bothered to update yet. iPad 1
- jaz 15y ago4.3.2 worked for me (iPad 1). Perhaps you have a previous version?
- michh 15y agoIt works on the iPhone 4 as well (or at least: it did on mine). Was amazed by how fast and easy that was.
- msh 15y agoWorks fine on my 3GS running 4.3.3
- vizzah 15y ago+1. flawless.
- schrototo 15y agoI hope they fix this fast, this is a huge security risk.
- Swannie 15y agoIndeed, and Comex gave them a heads up ~3.5 weeks ago that something was amiss in PDF. Let's hope they found it and are just going through the last testing cycles for the new patch?!
- demonfly 15y agoI used Fiddler to sniff traffic between iPad 2 and Jailbreakme during jailbreaking but I did not found where the PDF files are located. Could you help me find out where are PDFs that contains the exploits?
- JonnieCache 15y agoThere is no PDF file, the pdf is a base64 encoded data-uri in the javascript, in the page itself, not even in a separate asset. For those who fancy doing some analysis, here's the curl command with the required ipad UA string: curl -A "Mozilla/5.0 (iPad; U; CPU OS 4_3 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8F190 Safari/6533.18.5" http://www.jailbreakme.com EDIT: here's the b64 pdf: http://pastebin.com/69tnPMdV http://pastebin.com/69tnPMdV the PDF is very invalid, because it never needs to masquerade as a real document, it doesn't have to pretend to implement the PDF spec correctly. This makes it somewhat resistant to analysis, it doesn't even have the required '%%EOF' marker so many tools choke on it immediately. EDIT: There's an unterminated stream object in there which doesn't have a type, and it also has a declared length of 61 bytes and an actual length of well over 400. I think we have a winner... Unfortunately iOS shellcode analysis is waaaay over my head so I'll have to do something useful instead.
- mrspeaker 15y agoIs there a way to decompile the base64 code into the actual script? I'm guessing the shellcode is the bits after the AAAAAAA's?
- kristofferR 15y agohttp://pastebin.com/YuPrMhiE http://pastebin.com/YuPrMhiE It doesn't make that much more sense to me, but atleast you can see some commands.
- gary4gar 15y agoI decoded base64 & got this: https://gist.github.com/1067129 https://gist.github.com/1067129 bunch of random gibberish?
- wofser 15y agoI never bothered with any Jailbreaks before. I have a 3GS since 2 years back. Visited the site with my iPhone. Pressed Install. No confirmation or anything. Now I have a Cydia app on my phone that I can move but not delete. Was that all it took to jailbreak my phone? (It took like 10 seconds)
- X-Istence 15y agoYep, your phone is now jailbroken.
- 18pfsmt 15y agoYou should probably change your root password at this point since the default root password is the same for all devices.
- wofser 15y agoEven if I don't install OpenSSH from Cydia?
- desigooner 15y agoThe first thing I tried was to change the password (iPhone 4 4.3.3) after jailbreaking but the MobileTerminal crashes upon launch. Same story after a phone restart. Edit: Figured out the problem. Looks like the MobileTerminal in the CYdia repo doesn't work for iOS 4.0 onwards. The following is a working version from the author of the app: http://code.google.com/p/mobileterminal/wiki/Installation http://code.google.com/p/mobileterminal/wiki/Installation
- mrspeaker 15y agoI know it's obvious enough and not really scary - but that page is tracking every jailbreak and failed jailbreak: // track jailbreaks! _gaq.push(['_trackEvent', 'jailbreak', 'jailbreak']); timeout = setTimeout(function() { _gaq.push(['_trackEvent', 'failed', 'failure']); goto('failure'); }, 5000);
- comex 15y agoIt's just Google Analytics, with custom events so we can get statistics about failure.
- rakkhi 15y agoI wrote this when the original Jailbreak for iOS came out. Think mitigations still apply but not implemented by Apple http://www.rakkhis.com/2010/08/can-chrome-learn-from-iphone-jailbreak.html http://www.rakkhis.com/2010/08/can-chrome-learn-from-iphone-...
- kristofferR 15y agoThe release of this is probably related to the leak [1]. My guess is that they intended to save this for iOS5, but had to release it now due to the beta leak. [1] http://www.iphonedownloadblog.com/2011/07/02/jailbreakme-ipad-2-jailbreak-leaked/ http://www.iphonedownloadblog.com/2011/07/02/jailbreakme-ipa...
- Swannie 15y agoIndeed, his twitter stream has him complaining about people asking him to hurry up :P (http://twitter.com/#!/comex/status/84126363598065664 http://twitter.com/#!/comex/status/84126363598065664) The leak prompted quick action, lest Apple close the bus sized hole.
- deleted 15y ago[deleted]
- ianterrell 15y agoIf Apple made an official jailbreak they'd stop getting all this free penetration testing.
- glhaynes 15y agoWould they? Windows still seems to get lots of free penetration testing...
- Torn 15y agoSo I've installed Cydia for the first time on my 3GS, and am wanting to use the 'PDF Patcher 2' fix to stop other sites doing driveby exploits. Seems that results for the bigboss repository aren't being returned in Cydia, and the repo backend isn't responding to requests. http://apt.thebigboss.org/onepackage.php?bundleid=pdfpatch2 http://apt.thebigboss.org/onepackage.php?bundleid=pdfpatch2 Anyone else thinking the bigboss repo (only source of the pdf patcher 2, as far as I can tell) is being kept down on purpose?
- matthew-wegner 15y agoI doubt it. The last time there was a public jailbreakme.com exploit many of the popular Cydia repositories had major load issues for a few days.
- Xuzz 15y ago(I just asked BigBoss about this.) No, it's down due to an insane traffic load. It'll be up as soon as either a) traffic gets less insane (not likely to happen soon) or b) BigBoss adds more capacity. I'd also suggest to just keep trying: it'll likely work to install just that if you just keep trying to download it (eventually). Edit: I've put up a copy of it here, you can install this with "dpkg -i" on the device (via SSH): http://dl.dropbox.com/u/3177211/pdfpatch2_1_iphoneos-arm.deb http://dl.dropbox.com/u/3177211/pdfpatch2_1_iphoneos-arm.deb
- smackfu 15y agoDoes anyone know how Cydia licensing actually works? I jailbroke just to install RetinaPad, and I managed to buy it and install it. Cydia says "Package Officially Purchased". RetinaPad says "RetinaPad license missing!" and doesn't work. I guess the license download failed or something (due to high load?) but I don't see how to fix it. It really makes me appreciate the Apple App Store, to be honest.
- ryanpetrich 15y agoAll Cydia Store purchases go through SaurikIT's centralized payment processing server. When the user attempts installing a store package, the repo that hosts it queries the central licensing server to see if the device is authorized before returning the package. Some packages make additional calls after the package has been installed on the device to download a license. It is this final step that was failing intermittently on my servers due to the insane load (~300x usual sales on this package, ~125x traffic load overall). Please give it a try now, I have verified that it is up.
- Aqua_Geek 15y agoI'm intrigued how OTA OS updates will affect Apple's response time to exploits like this.
- xorglorb 15y agoGiven that they are delta updates, they will probably be able to push a patch within a few days. Let's hope they take advantage of it.