5 ms·
They'd also need access to Apple's private keys.
by hrrsn 13y ago
They'd also need access to Apple's private keys.
- gojomo 13y agoNot at all: that's the bug. It's not properly verifying that the other-end of a TLS session is the entity able to sign with the certificate-declared private-key.
- ef4 13y agoMost likely hrrsn was referring to code-signing keys. Even if you can successfully MITM a software update connection, iOS won't run your trojan unless it's got a valid signature. Of course the jailbreaking community knows well that there have been many ways around that...