3 ms·

Tachy0n: The Last 0day Jailbreak

265 points by todsacerdoti 1y ago

ivanjermakov 1y ago
If this is the case Apple employed an amazing strategy. By locking all ways to possibly root their devices they patch vulnerabilities discovered for free by jailbreak devs.
- ejpir 1y ago
  but they haven't, the article says the "private" community still has exploits and apple patches them. The public, like the dev, for some reason, don't anymore.
  - tptacek 1y ago
    They're exclusive to private communities because they're very expensive, and getting more expensive over time; in other words, Apple's strategy has driven the cost of exploiting iOS up. Anything public is dead, which is what you want to see.
    - bri3d 1y ago
      I’m not sure I agree with the premise here, although I agree with the conclusion w.r.t Apple specifically. I’m 100% positive from experience doing VR in several non-iOS spaces that increased exploit value leads to fewer published public exploits, but! This is not a sign that there are fewer available exploits or that the platform is more difficult to exploit, just a sign that multiple (and sometimes large numbers) of competing factions are hoarding exploits privately that might otherwise be released and subsequently fixed. As a complementary axiom, I believe that exploit value follows target value more closely than it does exploit difficulty, because the supply of competent vulnerability researchers is more constrained than the number of available targets. That is to say, someone will buy a simple exploit that pops a high value target (hello, shitty Android phones) for much more money than a complex exploit that pops a low value target. There are plenty of devices with high exploit value and low exploit publication rate that also have garbage security. With that said, Apple specifically are a special (and perhaps the only) case where they are “winning” and people are genuinely giving up on research because the results aren’t worth the value. I just don’t think this follows across the industry.
      - tptacek 1y ago
        I don't think I reach the deeper questions here, and pretty much just get back to "if it was cheap, Apple would have killed it already"; in that set of circumstances there can't be viable public exploits (or broad workable bug classes to fish from) to work with. Sucks if you're part of a public jailbreaking community, but, of course, good if you're a user.
        pona-a 1y ago
        But it's still more of obfuscation. You're effectively reducing the pool of researchers to those most likely to turn to the dark market. There's an entire zero-day industry privately developing exploits, and the public sees none of it. Sure, low-resource attackers can probably forget about exploiting iOS, but stuff like Pegasus still happens regularly.
        tptacek 1y ago
        Literally the alternative is more viable vulnerabilities. It's hard to understand a coherent argument that favors that over what we have now. We're in this situation because Apple has gotten good at killing whole bug classes. That's exactly what users want.
        bri3d 1y ago
        I agree with this. I also agree that there's no preferable situation. Apple have done a great job building mitigations and it shows in how difficult, expensive, and rare it is to fully exploit their platforms. I certainly wasn't intending to form a counter-argument that public exploits existing would be a positive signal, or that there's a preferable alternative situation. My only point was that "anything public is dead is what you want to see" is not a particularly useful rubric in general. I get nervous when I see statements that suggest an absence of public exploit material or high "bid" price for grey market exploits as evidence that a platform is less vulnerable. My experience suggests this isn't really how the market works in general. There are way too many additional factors that affect both pricing and publication to use "public exploit availability" or "grey-market bid price" as a signal about a platform's security posture overall. Anyway, reading back, I realize that you specifically weren't trying to draw that conclusion, but sibling comments are now - and it seems to be a really easy trap to fall into. See: every "security journalism" outlet every time a broker posts an Android bid that's higher than their standing iOS bid, or vendors and OEMs claiming their devices are secure because no public exploits exist.
  - numpad0 1y ago
    Jailbreaks need an itch to scratch. There isn't one for Ubuntu Desktop.
  - hsbauauvhabzb 1y ago
    Is this actually true? Jailbreaks are more or less the same exploits used by things like Pegasus, the exploits are probably worth more to the individuals that discover them than the ability to give their friends access to side loaded apps
    - burnt-resistor 1y ago
      That's the rub of relative integrity. It's variably easier for some to rationalize taking the cash, even if that giant pile of coin is likely to lead to the imprisonment, deaths, and/or torturing of others for better or for worse.
      - hsbauauvhabzb 1y ago
        My question wasn’t about ethics and I’d rather keep it that way.
weinzierl 1y ago
I've heard Apple pays a million for Jailbreaks now. That's the lower bound for the price on the free market.
- ThinkBeat 1y ago
  Is there a way to contact Apple to apply for millions of dollars if one has a jailbreak? X: Hi AppLE I haz jailb8? Or is it via one of the intermediaries? Or is there an email or some such that is published? (That will not to straight to 1st level support and forgotten about)
  - charcircuit 1y ago
    https://security.apple.com/bounty/ https://security.apple.com/bounty/
- conradev 1y ago
  > now That boundary was broken in 2015, about a decade ago: https://www.dailymail.co.uk/sciencetech/article-3301691/New-iPhone-hacked-Unknown-researcher-awarded-1m-jail-breaking-latest-iOS.html https://www.dailymail.co.uk/sciencetech/article-3301691/New-...
  - halJordan 1y ago
    That's cool, Apple's bug bounty didn't exist ten years ago. Apple's bug bounty does max out at $1 million (although you can get bonus multipliers up to $2mil). Just read the content before throwing down the gotcha.
  - Thorrez 1y ago
    That 1M was not paid by Apple. It was paid by Zerodium, a company that sold/sells vulnerabilities to attackers (e.g. NSA).
- lern_too_spel 1y ago
  That's the market rate. https://cyberscoop.com/zerodium-android-zero-days-bounty/ https://cyberscoop.com/zerodium-android-zero-days-bounty/
yjftsjthsd-h 1y ago
> The way he managed to beat a trillion dollar corporation was through the kind of simple but tedious and boring work that Apple sucks at: regression testing. > Because, you see: this has happened before. On iOS 12, SockPuppet was one of the big exploits used by jailbreaks. It was found and reported to Apple by Ned Williamson from Project Zero, patched by Apple in iOS 12.3, and subsequently unrestricted on the Project Zero bug tracker. But against all odds, it then resurfaced on iOS 12.4, as if it had never been patched. I can only speculate that this was because Apple likely forked XNU to a separate branch for that version and had failed to apply the patch there, but this made it evident that they had no regression tests for this kind of stuff. A gap that was both easy and potentially very rewarding to fill. And indeed, after implementing regression tests for just a few known 1days, Pwn got a hit. And now I wonder how many other projects are doing this. Is anyone running a CI farm running historical vulnerabilities on new versions of Linux/FreeBSD/OpenWRT/OpenSSH/...? It would require that someone wrote up each vulnerability in automated form (a low bar, I think), have the CI resources to throw at it (higher bar, though you could save by running a random selection on each new version), care (hopefully easy), and think of it (surprisingly hard).
- KennyBlanken 1y ago
  > And now I wonder how many other projects are doing this. If by 'projects' you mean intelligence agencies, then I would say it's safe to assume at least the G10 intelligence agencies are doing this along with Russia, China, NK - and likely a huge number of private groups.
- bcoates 1y ago
  I think the underlying problem is that lots of orgs have siloed out security stuff into its own workflow and its own class of bugs. It's basically Conway's law applied to the security/feature development split. So even if they have a build/release procedure with a mature regression test suite it probably wouldn't have "security" issues like this in it just as a matter of internal organization
- jdwithit 1y ago
  Yes, regression testing--making sure bugs you've fixed don't return--is a standard part of QA. I did volunteer QA for Mozilla in college a good 20 years ago (god that number is horrifying) and they had an ever-growing suite of regression tests. Mostly for rendering/layout or JavaScript engine bugs, since part of reproducing and proving you'd fixed those was creating a minimal test case. Which you could then easily throw into the build pipeline. Bugs are a fact of life, but burning time and money to fix them only to have them return is the worst case scenario. Organizations that care about quality are definitely investing in regression testing. Unfortunately a whole lot of orgs give QA zero respect and offshore it to the lowest bidder, if they do it at all. It's absolutely insane to me that Apple wouldn't have regression tests for jail breaks, some of the most high profile bugs in history. You can fairly criticize Mozilla for a number of things these days. But they had a very robust QA and CI/CD setup in the early 2000s with tools like Tinderbox and Bugzilla. When DevOps came around and popularized it I was like wait, people weren't already doing this stuff??? Turned out I had been living in a bubble and that was not the norm at all.
deleted 1y ago
[deleted]
dylan604 1y ago
[flagged]
- Bender 1y ago
  It may be they believe they created a new word trying to sound how a l33t hax0r would present themselves and did not realize it was already in use. [1] [1] - https://www.urbandictionary.com/define.php?term=jailbait https://www.urbandictionary.com/define.php?term=jailbait
- dymk 1y ago
  Can you really not tell from context what they mean, even though that slang has a different meaning?
  - dylan604 1y ago
    [flagged]
Garonte2001 1y ago
[flagged]
0x38B 1y ago
> forget everything you know about kheap separation, forget all the task port mitigations, forget SSV and SPTM This is like when you’re speaking in a foreign language with a friend and getting along fine, but in the next sentence they begin describing brain surgery or nuclear physics, and your understanding falls off a cliff. Or that time I tried to interpret a conversation about blast furnace renovations. As far as jailbreaks go, I’m sad it’s not a thing anymore; I don’t think I ever did anything useful with my jailbroken iPad, but it was fun. Today I’d install a tethering app and UTM + a JIT solution (1). 1: SideStore looked promising, but my account was once a paid Apple Developer account and I have 10 app IDs that won’t expire, so I can’t install any apps like the aforementioned UTM, unless I make a new account or pay again.
- xandrius 1y ago
  I had my old iPhone 4 jailbroken and it was literally the only way I would use an iPhone as my main device. Having lost that, I switched back to Android which had caught up in many basic features by then.
viscousviolin 1y ago
I'm no security researcher, but this hits close to home for me personally.
- dmvdoug 1y ago
  Thoughts and prayers during your time of mitigation.
greggh 1y ago
My favorite line from the whole post "I’d also like to thank whoever unpatched the bug in iOS 13.0. That was a very cool move too."
Hilift 1y ago
> I can’t possibly imagine where we’ll be in 5 years from now. I can. iMessage still allows device, account, and data takeovers.
peterburkimsher 1y ago
Tethered or untethered? The article didn’t say.
- Retr0id 1y ago
  tachy0n is an LPE, so that's not really a relevant classification. The jailbreak it was deployed as part of, unc0ver, is "semi-untethered" afaik.
  - peterburkimsher 1y ago
    Cool, thanks for answering! unc0ver is this one, btw: https://unc0ver.dev/ https://unc0ver.dev/
Stem0037 1y ago
[dead]

265 points by todsacerdoti 1y ago

If this is the case Apple employed an amazing strategy. By locking all ways to possibly root their devices they patch vulnerabilities discovered for free by jailbreak devs.

ejpir 1y ago
but they haven't, the article says the "private" community still has exploits and apple patches them. The public, like the dev, for some reason, don't anymore.
- tptacek 1y ago
  They're exclusive to private communities because they're very expensive, and getting more expensive over time; in other words, Apple's strategy has driven the cost of exploiting iOS up. Anything public is dead, which is what you want to see.
  - bri3d 1y ago
    I’m not sure I agree with the premise here, although I agree with the conclusion w.r.t Apple specifically. I’m 100% positive from experience doing VR in several non-iOS spaces that increased exploit value leads to fewer published public exploits, but! This is not a sign that there are fewer available exploits or that the platform is more difficult to exploit, just a sign that multiple (and sometimes large numbers) of competing factions are hoarding exploits privately that might otherwise be released and subsequently fixed. As a complementary axiom, I believe that exploit value follows target value more closely than it does exploit difficulty, because the supply of competent vulnerability researchers is more constrained than the number of available targets. That is to say, someone will buy a simple exploit that pops a high value target (hello, shitty Android phones) for much more money than a complex exploit that pops a low value target. There are plenty of devices with high exploit value and low exploit publication rate that also have garbage security. With that said, Apple specifically are a special (and perhaps the only) case where they are “winning” and people are genuinely giving up on research because the results aren’t worth the value. I just don’t think this follows across the industry.
    - tptacek 1y ago
      I don't think I reach the deeper questions here, and pretty much just get back to "if it was cheap, Apple would have killed it already"; in that set of circumstances there can't be viable public exploits (or broad workable bug classes to fish from) to work with. Sucks if you're part of a public jailbreaking community, but, of course, good if you're a user.
      - pona-a 1y ago
        But it's still more of obfuscation. You're effectively reducing the pool of researchers to those most likely to turn to the dark market. There's an entire zero-day industry privately developing exploits, and the public sees none of it. Sure, low-resource attackers can probably forget about exploiting iOS, but stuff like Pegasus still happens regularly.
        tptacek 1y ago
        Literally the alternative is more viable vulnerabilities. It's hard to understand a coherent argument that favors that over what we have now. We're in this situation because Apple has gotten good at killing whole bug classes. That's exactly what users want.
      - bri3d 1y ago
        I agree with this. I also agree that there's no preferable situation. Apple have done a great job building mitigations and it shows in how difficult, expensive, and rare it is to fully exploit their platforms. I certainly wasn't intending to form a counter-argument that public exploits existing would be a positive signal, or that there's a preferable alternative situation. My only point was that "anything public is dead is what you want to see" is not a particularly useful rubric in general. I get nervous when I see statements that suggest an absence of public exploit material or high "bid" price for grey market exploits as evidence that a platform is less vulnerable. My experience suggests this isn't really how the market works in general. There are way too many additional factors that affect both pricing and publication to use "public exploit availability" or "grey-market bid price" as a signal about a platform's security posture overall. Anyway, reading back, I realize that you specifically weren't trying to draw that conclusion, but sibling comments are now - and it seems to be a really easy trap to fall into. See: every "security journalism" outlet every time a broker posts an Android bid that's higher than their standing iOS bid, or vendors and OEMs claiming their devices are secure because no public exploits exist.
- numpad0 1y ago
  Jailbreaks need an itch to scratch. There isn't one for Ubuntu Desktop.
- hsbauauvhabzb 1y ago
  Is this actually true? Jailbreaks are more or less the same exploits used by things like Pegasus, the exploits are probably worth more to the individuals that discover them than the ability to give their friends access to side loaded apps
  - burnt-resistor 1y ago
    That's the rub of relative integrity. It's variably easier for some to rationalize taking the cash, even if that giant pile of coin is likely to lead to the imprisonment, deaths, and/or torturing of others for better or for worse.
    - hsbauauvhabzb 1y ago
      My question wasn’t about ethics and I’d rather keep it that way.

weinzierl 1y ago

I've heard Apple pays a million for Jailbreaks now. That's the lower bound for the price on the free market.

ThinkBeat 1y ago
Is there a way to contact Apple to apply for millions of dollars if one has a jailbreak? X: Hi AppLE I haz jailb8? Or is it via one of the intermediaries? Or is there an email or some such that is published? (That will not to straight to 1st level support and forgotten about)
- charcircuit 1y ago
  https://security.apple.com/bounty/ https://security.apple.com/bounty/
conradev 1y ago
> now That boundary was broken in 2015, about a decade ago: https://www.dailymail.co.uk/sciencetech/article-3301691/New-iPhone-hacked-Unknown-researcher-awarded-1m-jail-breaking-latest-iOS.html https://www.dailymail.co.uk/sciencetech/article-3301691/New-...
- halJordan 1y ago
  That's cool, Apple's bug bounty didn't exist ten years ago. Apple's bug bounty does max out at $1 million (although you can get bonus multipliers up to $2mil). Just read the content before throwing down the gotcha.
- Thorrez 1y ago
  That 1M was not paid by Apple. It was paid by Zerodium, a company that sold/sells vulnerabilities to attackers (e.g. NSA).
lern_too_spel 1y ago
That's the market rate. https://cyberscoop.com/zerodium-android-zero-days-bounty/ https://cyberscoop.com/zerodium-android-zero-days-bounty/

yjftsjthsd-h 1y ago

> The way he managed to beat a trillion dollar corporation was through the kind of simple but tedious and boring work that Apple sucks at: regression testing. > Because, you see: this has happened before. On iOS 12, SockPuppet was one of the big exploits used by jailbreaks. It was found and reported to Apple by Ned Williamson from Project Zero, patched by Apple in iOS 12.3, and subsequently unrestricted on the Project Zero bug tracker. But against all odds, it then resurfaced on iOS 12.4, as if it had never been patched. I can only speculate that this was because Apple likely forked XNU to a separate branch for that version and had failed to apply the patch there, but this made it evident that they had no regression tests for this kind of stuff. A gap that was both easy and potentially very rewarding to fill. And indeed, after implementing regression tests for just a few known 1days, Pwn got a hit. And now I wonder how many other projects are doing this. Is anyone running a CI farm running historical vulnerabilities on new versions of Linux/FreeBSD/OpenWRT/OpenSSH/...? It would require that someone wrote up each vulnerability in automated form (a low bar, I think), have the CI resources to throw at it (higher bar, though you could save by running a random selection on each new version), care (hopefully easy), and think of it (surprisingly hard).

KennyBlanken 1y ago
> And now I wonder how many other projects are doing this. If by 'projects' you mean intelligence agencies, then I would say it's safe to assume at least the G10 intelligence agencies are doing this along with Russia, China, NK - and likely a huge number of private groups.
bcoates 1y ago
I think the underlying problem is that lots of orgs have siloed out security stuff into its own workflow and its own class of bugs. It's basically Conway's law applied to the security/feature development split. So even if they have a build/release procedure with a mature regression test suite it probably wouldn't have "security" issues like this in it just as a matter of internal organization
jdwithit 1y ago
Yes, regression testing--making sure bugs you've fixed don't return--is a standard part of QA. I did volunteer QA for Mozilla in college a good 20 years ago (god that number is horrifying) and they had an ever-growing suite of regression tests. Mostly for rendering/layout or JavaScript engine bugs, since part of reproducing and proving you'd fixed those was creating a minimal test case. Which you could then easily throw into the build pipeline. Bugs are a fact of life, but burning time and money to fix them only to have them return is the worst case scenario. Organizations that care about quality are definitely investing in regression testing. Unfortunately a whole lot of orgs give QA zero respect and offshore it to the lowest bidder, if they do it at all. It's absolutely insane to me that Apple wouldn't have regression tests for jail breaks, some of the most high profile bugs in history. You can fairly criticize Mozilla for a number of things these days. But they had a very robust QA and CI/CD setup in the early 2000s with tools like Tinderbox and Bugzilla. When DevOps came around and popularized it I was like wait, people weren't already doing this stuff??? Turned out I had been living in a bubble and that was not the norm at all.

deleted 1y ago

[deleted]

dylan604 1y ago

[flagged]

Bender 1y ago
It may be they believe they created a new word trying to sound how a l33t hax0r would present themselves and did not realize it was already in use. [1] [1] - https://www.urbandictionary.com/define.php?term=jailbait https://www.urbandictionary.com/define.php?term=jailbait
dymk 1y ago
Can you really not tell from context what they mean, even though that slang has a different meaning?
- dylan604 1y ago
  [flagged]

Garonte2001 1y ago

[flagged]

0x38B 1y ago

> forget everything you know about kheap separation, forget all the task port mitigations, forget SSV and SPTM This is like when you’re speaking in a foreign language with a friend and getting along fine, but in the next sentence they begin describing brain surgery or nuclear physics, and your understanding falls off a cliff. Or that time I tried to interpret a conversation about blast furnace renovations. As far as jailbreaks go, I’m sad it’s not a thing anymore; I don’t think I ever did anything useful with my jailbroken iPad, but it was fun. Today I’d install a tethering app and UTM + a JIT solution (1). 1: SideStore looked promising, but my account was once a paid Apple Developer account and I have 10 app IDs that won’t expire, so I can’t install any apps like the aforementioned UTM, unless I make a new account or pay again.

xandrius 1y ago
I had my old iPhone 4 jailbroken and it was literally the only way I would use an iPhone as my main device. Having lost that, I switched back to Android which had caught up in many basic features by then.

viscousviolin 1y ago

I'm no security researcher, but this hits close to home for me personally.

dmvdoug 1y ago
Thoughts and prayers during your time of mitigation.

greggh 1y ago

My favorite line from the whole post "I’d also like to thank whoever unpatched the bug in iOS 13.0. That was a very cool move too."

Hilift 1y ago

> I can’t possibly imagine where we’ll be in 5 years from now. I can. iMessage still allows device, account, and data takeovers.

peterburkimsher 1y ago

Tethered or untethered? The article didn’t say.

Retr0id 1y ago
tachy0n is an LPE, so that's not really a relevant classification. The jailbreak it was deployed as part of, unc0ver, is "semi-untethered" afaik.
- peterburkimsher 1y ago
  Cool, thanks for answering! unc0ver is this one, btw: https://unc0ver.dev/ https://unc0ver.dev/

Stem0037 1y ago

[dead]