7 ms·

And a much older bug with TIF rendering in iOS 4 used by jailbreakme.com back in the day. It was wonderful pressing a button in Safari and suddenly seeing my iP

And a much older bug with TIF rendering in iOS 4 used by jailbreakme.com back in the day. It was wonderful pressing a button in Safari and suddenly seeing my iPod touch reboot with Cydia installed.

l33t7332273 3y ago
I would describe a one click rootkit as terrifying as opposed to wonderful.
- c0pium 3y ago
  If it makes you feel better the click was actually unnecessary theater.
  - dhosek 3y ago
    Yeah, the whole way that the jailbreaks installed was scary enough for me to never want to go near them.
    - hot_gril 3y ago
      Your phone would reboot with a pineapple logo and console messages flying across the screen like a 1337 h4cker, starting with the "regents of the University of California, Berkeley" message. Then you'd go install a ton of Cydia hacks.
      - l33t7332273 3y ago
        What is the significance of the “regents of the University of California, Berkeley” message? Is it the FreeBSD boot message?
        saagarjha 3y ago
        iOS has BSD roots.
        hot_gril 3y ago
        Right, just BSD, not FreeBSD. Same with macOS, which also features that boot message.
  - lxgr 3y ago
    Running an exploit against any visiting device without a disclaimer/button probably gets you into very spicy territory from a legal point of view.
- deleted 3y ago
  [deleted]
- hot_gril 3y ago
  It was a different time. There was nothing on my iPod touch that mattered enough.
  - hot_gril 3y ago
    (And I could even patch the vulnerability via jailbreaking, haha)
- midasuni 3y ago
  I also find the inability to get root on my device terrifying
- pxmpxm 3y ago
  I guess you've never had sudo before.
  - l33t7332273 3y ago
    I don’t see the analogy. If I could visit a website and it runs sudo commands on my machine without my input then I would be scared.
    - hot_gril 3y ago
      Or non-sudo commands for that matter
acdha 3y ago
This is the frustrating part: that is cool from a technical perspective but terrifying when you think about this stuff being used to target journalists, activists, etc. Maybe not everyone gets the bone saw but some will - and from the sounds of it it’s people standing up to abusive people: > Last week, while checking the device of an individual employed by a Washington DC-based civil society organization with international offices, Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware.
- 14 3y ago
  What is frustrating is the NSO group continues to exist despite all the bad they do. How many people are they responsible for being on the receiving end of a bone saw?
  - cumshitpiss 3y ago
    It continues to exist because state governments have an interest for it to exist Check out The Palestine Laboratory: How Israel Exports the Technology of Occupation Around the World
  - mensetmanusman 3y ago
    If they didn’t exist it would be a different company in Russia or China. The demand exists.
    - mrbombastic 3y ago
      Maybe that’s true, it probably is, but they should still be sanctioned into oblivion considering they consistently are in the headlines on the wrong end of this being used for deeply questionable purposes.
      - kevin_thibedeau 3y ago
        The US enjoys some fruits of their labor and they're conveniently distanced from any explicitly funded operations to avoid blow back when exploits are publicized. They won't enforce sanctions or, more practically, withhold the massive defense subsidies they give to Israel.
koito17 3y ago
Huh? I could've sworn the TIFF bug was during the iPhoneOS 1.x days. I recall jailbreakme's exploit using corrupted fonts in a PDF, not TIFF images. A quick Google search led me to this https://appleinsider.com/articles/10/08/03/browser_based_ios_jailbreak_utilizes_scary_pdf_security_hole https://appleinsider.com/articles/10/08/03/browser_based_ios...
- dunham 3y ago
  Yeah, the tiff bug was one of the the first few iOS jailbreaks. The wiki says 1.0-1.1.1: https://www.theiphonewiki.com/wiki/LibTiff_Exploit https://www.theiphonewiki.com/wiki/LibTiff_Exploit I wrote a patch to fix it that one of the jailbreaks used. I wasn't in the scene, but wanted to protect my ipod touch. So I figured out a patch and gave it to somebody named "pumpkin" on IRC. It's been a long time, but I remember it was fun to learn ARM assembly and figure out how to rewrite the code to get enough space to insert a test and return.
- hot_gril 3y ago
  You're right, iOS 4 jailbreakme was PDF. But jailbreakme also existed for 1.x, using TIFF. https://en.wikipedia.org/wiki/JailbreakMe https://en.wikipedia.org/wiki/JailbreakMe

And a much older bug with TIF rendering in iOS 4 used by jailbreakme.com back in the day. It was wonderful pressing a button in Safari and suddenly seeing my iPod touch reboot with Cydia installed.

l33t7332273 3y ago

I would describe a one click rootkit as terrifying as opposed to wonderful.

c0pium 3y ago
If it makes you feel better the click was actually unnecessary theater.
- dhosek 3y ago
  Yeah, the whole way that the jailbreaks installed was scary enough for me to never want to go near them.
  - hot_gril 3y ago
    Your phone would reboot with a pineapple logo and console messages flying across the screen like a 1337 h4cker, starting with the "regents of the University of California, Berkeley" message. Then you'd go install a ton of Cydia hacks.
    - l33t7332273 3y ago
      What is the significance of the “regents of the University of California, Berkeley” message? Is it the FreeBSD boot message?
      - saagarjha 3y ago
        iOS has BSD roots.
        hot_gril 3y ago
        Right, just BSD, not FreeBSD. Same with macOS, which also features that boot message.
- lxgr 3y ago
  Running an exploit against any visiting device without a disclaimer/button probably gets you into very spicy territory from a legal point of view.
deleted 3y ago
[deleted]
hot_gril 3y ago
It was a different time. There was nothing on my iPod touch that mattered enough.
- hot_gril 3y ago
  (And I could even patch the vulnerability via jailbreaking, haha)
midasuni 3y ago
I also find the inability to get root on my device terrifying
pxmpxm 3y ago
I guess you've never had sudo before.
- l33t7332273 3y ago
  I don’t see the analogy. If I could visit a website and it runs sudo commands on my machine without my input then I would be scared.
  - hot_gril 3y ago
    Or non-sudo commands for that matter

acdha 3y ago

This is the frustrating part: that is cool from a technical perspective but terrifying when you think about this stuff being used to target journalists, activists, etc. Maybe not everyone gets the bone saw but some will - and from the sounds of it it’s people standing up to abusive people: > Last week, while checking the device of an individual employed by a Washington DC-based civil society organization with international offices, Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware.

14 3y ago
What is frustrating is the NSO group continues to exist despite all the bad they do. How many people are they responsible for being on the receiving end of a bone saw?
- cumshitpiss 3y ago
  It continues to exist because state governments have an interest for it to exist Check out The Palestine Laboratory: How Israel Exports the Technology of Occupation Around the World
- mensetmanusman 3y ago
  If they didn’t exist it would be a different company in Russia or China. The demand exists.
  - mrbombastic 3y ago
    Maybe that’s true, it probably is, but they should still be sanctioned into oblivion considering they consistently are in the headlines on the wrong end of this being used for deeply questionable purposes.
    - kevin_thibedeau 3y ago
      The US enjoys some fruits of their labor and they're conveniently distanced from any explicitly funded operations to avoid blow back when exploits are publicized. They won't enforce sanctions or, more practically, withhold the massive defense subsidies they give to Israel.

koito17 3y ago

Huh? I could've sworn the TIFF bug was during the iPhoneOS 1.x days. I recall jailbreakme's exploit using corrupted fonts in a PDF, not TIFF images. A quick Google search led me to this https://appleinsider.com/articles/10/08/03/browser_based_ios_jailbreak_utilizes_scary_pdf_security_hole https://appleinsider.com/articles/10/08/03/browser_based_ios...

dunham 3y ago
Yeah, the tiff bug was one of the the first few iOS jailbreaks. The wiki says 1.0-1.1.1: https://www.theiphonewiki.com/wiki/LibTiff_Exploit https://www.theiphonewiki.com/wiki/LibTiff_Exploit I wrote a patch to fix it that one of the jailbreaks used. I wasn't in the scene, but wanted to protect my ipod touch. So I figured out a patch and gave it to somebody named "pumpkin" on IRC. It's been a long time, but I remember it was fun to learn ARM assembly and figure out how to rewrite the code to get enough space to insert a test and return.
hot_gril 3y ago
You're right, iOS 4 jailbreakme was PDF. But jailbreakme also existed for 1.x, using TIFF. https://en.wikipedia.org/wiki/JailbreakMe https://en.wikipedia.org/wiki/JailbreakMe