Earlier quoted context omitted.
Reboot your phone if you know you have given it to someone you don't trust.
This is a persistent compromise. That will not help.
No, it's exactly not that.
Tethered Jailbreaks Are Back
31–40 of 122 posts
Re: Tethered Jailbreaks Are Back
#32Earlier quoted context omitted.
It certainly will _feel_ persistent if you're successfully attacked with this technique. If your iOS software is swapped out for a version with a backdoor, then the attacker will have collected your passwords and authentication tokens to services you use. If you reboot to clear the backdoor (and let's be honest: no one reboots their phones), then you won't also "clear" your attacker's memory of all your passwords.
I reboot my phone once in a blue moon, but my phone reboots itself roughly every other day (usually because I space on charging it). Am I that unusual, or is "the phone is rarely going to reboot" not really a reliable predicate for attackers?
My reboot frequency is slightly more than 1.0 times per update, but less than 2.0 times per update.
Re: Tethered Jailbreaks Are Back
#33Re: Tethered Jailbreaks Are Back
#34Interesting that the writers of this article are a company that sells a library to help developers detect their app running on jailbroken devices. https://blog.trailofbits.com/2017/10/12/ios-jailbreak-detect...
Makes sense given how they try and spin this is only good for pirates (and researchers), because they would be the only ones who would like a jailbroken device.
A decade of corporate brainwashing has convinced people that only criminals want to control the device they own.
Re: Tethered Jailbreaks Are Back
#35Earlier quoted context omitted.
>library to help developers detect their app running on jailbroken devices How does this work? I thought iOS apps are sandboxed to an extent where it shouldn't be possible to snoop around to determine which processes are running and such.
A jailbroken device allows apps to do things that a non-jailbroken device does not. I maintain my company's in-house mobile app crash reporting system and I had to remove jailbreak checks from our iOS SDK. It turned out that some of the checks were causing crashes themselves due to buggy anti-jailbreak-detection code some jailbroken devices had in place. e.g. checking whether a file could be accessed that normally iO…
The proper way of doing things should be that an app controls access to jailbreak features. By default nothing gets them and you can whitelist the ones which need it. I'm not sure if anything like this exists for ios but it should.
Re: Tethered Jailbreaks Are Back
#36Earlier quoted context omitted.
> if there's a real security risk There is, but it's not that great. You need physical access to the device and it won't be persistent (a reboot will clean it).
> You need physical access I don't understand why people keep downplaying this. The whole point of a secure phone is that the data can't be accessed even with physical access.
You need physical access AND the device pin. None of these hacks allow you to decrypt the device without the pin. The best you can do is load malware that would grab the pin when the user types it in so the defense for this is if the government ever takes your phone for inspection make sure to reboot it before typing in a pin.
Re: Tethered Jailbreaks Are Back
#37[deleted]
Re: Tethered Jailbreaks Are Back
#38Earlier quoted context omitted.
How would such an attack (without this exploit) be pulled off?
For example, you could implant a hardware backdoor that monitors the touchscreen inputs
To do that, you'd need to disassemble the phone to insert your implant. That might be hard to do in the field (ie. not in a repair shop/lab setting with plenty of tools lying around). Not to mention the difficulties of designing and manufacturing an implant. How are you going to get it to fit? I don't think there's a lot of empty space inside a phone. How many variants would you need to design and carry around? I'd imagine that the iPhone SE would need a different implant than the iPhone XS, for example.
A bootrom attack allows you to replace all of that with plugging in your victim's device into your "hackbox" for 10 seconds. Vastly simpler to execute for your typical goon/henchmen and way less likely to get detected.
Re: Tethered Jailbreaks Are Back
#39Yay! I have fond memories of my friends (and eventually me, on the family iPad) jailbreaking our devices and doing stuff with them. A lot of the things I saw from jailbreaks were incorporated into later iOS updates- I'm curious (and excited!) to see what develops out of this wave.
What's the point now that we have Android?
Re: Tethered Jailbreaks Are Back
#40Earlier quoted context omitted.
> if there's a real security risk There is, but it's not that great. You need physical access to the device and it won't be persistent (a reboot will clean it).
It certainly will _feel_ persistent if you're successfully attacked with this technique. If your iOS software is swapped out for a version with a backdoor, then the attacker will have collected your passwords and authentication tokens to services you use. If you reboot to clear the backdoor (and let's be honest: no one reboots their phones), then you won't also "clear" your attacker's memory of all your passwords.
If your iOS version is swapped out with one that is backdoored, it won’t boot after you reboot it without using this boot loader exploit on a computer again.
This makes you ever so slightly more vulnerable to an evil maid attack, but we don’t even have a jailbreak yet using this so it’s to be determined how it all shakes out.