Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tethered Jailbreaks Are Back

blog.trailofbits.com

Post reply on HN
Print view View original

11–20 of 122 posts

Re: Tethered Jailbreaks Are Back

#11

Post by js2 »

krackers wrote: post #6
nerdbaggy wrote: post #2

Interesting that the writers of this article are a company that sells a library to help developers detect their app running on jailbroken devices. https://blog.trailofbits.com/2017/10/12/ios-jailbreak-detect...

>library to help developers detect their app running on jailbroken devices How does this work? I thought iOS apps are sandboxed to an extent where it shouldn't be possible to snoop around to determine which processes are running and such.

A jailbroken device allows apps to do things that a non-jailbroken device does not.

I maintain my company's in-house mobile app crash reporting system and I had to remove jailbreak checks from our iOS SDK. It turned out that some of the checks were causing crashes themselves due to buggy anti-jailbreak-detection code some jailbroken devices had in place. e.g. checking whether a file could be accessed that normally iOS disallows would end up causing a crash instead of just a permission error.

Instead, I just do some basic server-side detection. Basically, looking for libraries loaded into the app (e.g. cydia) that are only present on jailbroken devices. Some jailbreaks don't even try to hide their presence.

I don't know what iVerify does. I hadn't heard of it before. I'm curious how it avoids crashes though... perhaps it avoids invoking any dynamic system calls.

Re: Tethered Jailbreaks Are Back

#12

Post by dguido »

wklauss wrote: post #10
jasonhansel wrote: post #7

Honestly, if there's a real security risk, I'm surprised Apple hasn't recalled the phones or offered to repair them. Unpatchable firmware flaws are (or should be) no different from hardware flaws in this respect.

> if there's a real security risk There is, but it's not that great. You need physical access to the device and it won't be persistent (a reboot will clean it).

It certainly will _feel_ persistent if you're successfully attacked with this technique.

If your iOS software is swapped out for a version with a backdoor, then the attacker will have collected your passwords and authentication tokens to services you use. If you reboot to clear the backdoor (and let's be honest: no one reboots their phones), then you won't also "clear" your attacker's memory of all your passwords.

Re: Tethered Jailbreaks Are Back

#13

Post by jplayer01 »

wklauss wrote: post #10
jasonhansel wrote: post #7

Honestly, if there's a real security risk, I'm surprised Apple hasn't recalled the phones or offered to repair them. Unpatchable firmware flaws are (or should be) no different from hardware flaws in this respect.

> if there's a real security risk There is, but it's not that great. You need physical access to the device and it won't be persistent (a reboot will clean it).

> You need physical access

I don't understand why people keep downplaying this. The whole point of a secure phone is that the data can't be accessed even with physical access.

Re: Tethered Jailbreaks Are Back

#14

Post by shawnz »

jplayer01 wrote: post #13
wklauss wrote: post #10

Earlier quoted context omitted.

> if there's a real security risk There is, but it's not that great. You need physical access to the device and it won't be persistent (a reboot will clean it).

> You need physical access I don't understand why people keep downplaying this. The whole point of a secure phone is that the data can't be accessed even with physical access.

The attack where you implant some kind of backdoor to capture the data is possible even without this exploit, it just makes it easier.

Re: Tethered Jailbreaks Are Back

#15

Post by dguido »

krackers wrote: post #6
nerdbaggy wrote: post #2

Interesting that the writers of this article are a company that sells a library to help developers detect their app running on jailbroken devices. https://blog.trailofbits.com/2017/10/12/ios-jailbreak-detect...

>library to help developers detect their app running on jailbroken devices How does this work? I thought iOS apps are sandboxed to an extent where it shouldn't be possible to snoop around to determine which processes are running and such.

We discovered/developed a suite of side channels that let us indirectly read iOS system state from inside the sandbox. There are many different checks across unknown deviations, known jailbreak files and utilities, and runtime behaviors that help us narrow down whether your phone has been modified. It's not perfect, but it's the best you can do from within the Apple App sandbox.

Re: Tethered Jailbreaks Are Back

#16

Post by [deleted] »

dguido wrote: post #12
wklauss wrote: post #10

Earlier quoted context omitted.

> if there's a real security risk There is, but it's not that great. You need physical access to the device and it won't be persistent (a reboot will clean it).

It certainly will _feel_ persistent if you're successfully attacked with this technique. If your iOS software is swapped out for a version with a backdoor, then the attacker will have collected your passwords and authentication tokens to services you use. If you reboot to clear the backdoor (and let's be honest: no one reboots their phones), then you won't also "clear" your attacker's memory of all your passwords.

[deleted]

Re: Tethered Jailbreaks Are Back

#17

Post by brudgers »

wklauss wrote: post #10
jasonhansel wrote: post #7

Honestly, if there's a real security risk, I'm surprised Apple hasn't recalled the phones or offered to repair them. Unpatchable firmware flaws are (or should be) no different from hardware flaws in this respect.

> if there's a real security risk There is, but it's not that great. You need physical access to the device and it won't be persistent (a reboot will clean it).

Anything electronic connected via the lightening port has physical access for example: a charger. A charger could be programmed to let a device in a low battery state to run the rest of the way down to empty to cause a reboot before starting to recharge. Not undetectable. But typical users would probably assume user error or a faulty charger before suspecting malware.

Re: Tethered Jailbreaks Are Back

#19

Post by rodgerd »

This will delight the one person in ten thousand who wants to jailbreak their own phone, and the border police in Australia (mandatory scans of phone required on demand), or China, or stalkerware retailers, or repair shops who like to rat around on customers' phones.

Guess which will be the more common use?

Re: Tethered Jailbreaks Are Back

#20

Post by thejosh »

nerdbaggy wrote: post #2

Interesting that the writers of this article are a company that sells a library to help developers detect their app running on jailbroken devices. https://blog.trailofbits.com/2017/10/12/ios-jailbreak-detect...

Makes sense given how they try and spin this is only good for pirates (and researchers), because they would be the only ones who would like a jailbroken device.
Post reply on HN