Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tethered Jailbreaks Are Back

blog.trailofbits.com

Post reply on HN
Print view View original

101–110 of 122 posts

Re: Tethered Jailbreaks Are Back

#101

Post by dguido »

tptacek wrote: post #29
nerdbaggy wrote: post #2

Interesting that the writers of this article are a company that sells a library to help developers detect their app running on jailbroken devices. https://blog.trailofbits.com/2017/10/12/ios-jailbreak-detect...

Trail of Bits sells a jailbreak detection app the same way Ikea sells Swedish Meatballs. It's good jailbreak detection, but it's hardly what Trail is about.

lol that's a great analogy! Yes, this is a small project for roughly one person at our company of 50. It's something we felt like we could contribute so we had fun with it. We already invested all the time elsewhere to master iOS. It's one of those 30 minutes + 15 years experience things.

Re: Tethered Jailbreaks Are Back

#102

Post by dguido »

justicz wrote: post #26
dguido wrote: post #12

Earlier quoted context omitted.

It certainly will _feel_ persistent if you're successfully attacked with this technique. If your iOS software is swapped out for a version with a backdoor, then the attacker will have collected your passwords and authentication tokens to services you use. If you reboot to clear the backdoor (and let's be honest: no one reboots their phones), then you won't also "clear" your attacker's memory of all your passwords.

Ha, I wonder if an attacker could use this bug to prevent or fake the rebooting process by changing the behavior of the lock/volume buttons when they’re held. I know there’s also a “hard reset” you can do with volume up -> volume down -> power, not sure if that works at a lower level.

Yes, an attacker using checkm8 could do that if they had a separate exploit for persistence. That exploit would be in iOS and take over at a later point in the boot process, and it would be possible for Apple to patch it with an iOS update. Those bugs are hard to find, but there have been dozens discovered in the past.

Re: Tethered Jailbreaks Are Back

#103

Post by giancarlostoro »

dylan604 wrote: post #64
nerdbaggy wrote: post #9

Earlier quoted context omitted.

Apple isn’t really known for doing recalls until they absolutely have to

"Take the number of 'iPhones' in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one." A modified version of the movie quote to fit the discussion

"the movie quote" = Fight Club, since yes, there's people who have not seen that movie, but we don't talk about that.

Re: Tethered Jailbreaks Are Back

#104

Post by ESultanik »

Bnshsysjab wrote: post #73
js2 wrote: post #11

Earlier quoted context omitted.

A jailbroken device allows apps to do things that a non-jailbroken device does not. I maintain my company's in-house mobile app crash reporting system and I had to remove jailbreak checks from our iOS SDK. It turned out that some of the checks were causing crashes themselves due to buggy anti-jailbreak-detection code some jailbroken devices had in place. e.g. checking whether a file could be accessed that normally iO…

Out of interest, why do you care if your users run your application on a jailbroken device? It’s been a question I’ve had for a while..

Companies (particularly financial institutions) that have enterprise apps deployed only to their employees care because a jailbroken phone imposes the risk of attackers MITMing traffic.

Re: Tethered Jailbreaks Are Back

#105

Post by anfilt »

If anything this should be a boon to users. It allows them fully to use their devices they own. Honestly, it is inexcusable that apple makes users have to hack their own devices. You should have the option similar to enabling or disabling secure boot on your PC.

Re: Tethered Jailbreaks Are Back

#106

Post by withzombies »

selectodude wrote: post #40
dguido wrote: post #12

Earlier quoted context omitted.

It certainly will _feel_ persistent if you're successfully attacked with this technique. If your iOS software is swapped out for a version with a backdoor, then the attacker will have collected your passwords and authentication tokens to services you use. If you reboot to clear the backdoor (and let's be honest: no one reboots their phones), then you won't also "clear" your attacker's memory of all your passwords.

If your iOS version is swapped out with one that is backdoored, it won’t boot after you reboot it without using this boot loader exploit on a computer again. This makes you ever so slightly more vulnerable to an evil maid attack, but we don’t even have a jailbreak yet using this so it’s to be determined how it all shakes out.

You don't need to modify the kernel or iBoot on disk to inject a patched OS (or malware). redsn0w didn't, it would boot over dfu every time.

It's totally possible to rootkit a phone and have it reboot just fine (with the rootkit removed).

Re: Tethered Jailbreaks Are Back

#107

Post by Tepix »

wklauss wrote: post #10
jasonhansel wrote: post #7

Honestly, if there's a real security risk, I'm surprised Apple hasn't recalled the phones or offered to repair them. Unpatchable firmware flaws are (or should be) no different from hardware flaws in this respect.

> if there's a real security risk There is, but it's not that great. You need physical access to the device and it won't be persistent (a reboot will clean it).

Are you saying if an evil government puts a backdoor on my phone while I'm at customs, can I just reboot twice to completely get rid of it reliably?

But this hack also allows exfiltration of data from your phone, doesn't it?

Re: Tethered Jailbreaks Are Back

#108

Post by clairity »

paulcarroty wrote: post #91
jimmaswell wrote: post #39

Earlier quoted context omitted.

What's the point now that we have Android?

iOS doesn't sent your every click to Google? https://digitalcontentnext.org/wp-content/uploads/2018/08/DC...

as the paper notes, ios itself doesn’t send much to google. it’s primarily installed apps that send data to google, and that’s primarily advertising related. google apps will additionally send all your location data to google.

moral of the story: don’t install any google apps and limit the number of apps you install.

Re: Tethered Jailbreaks Are Back

#109

Post by lostgame »

anon9001 wrote: post #80
lostgame wrote: post #43

Earlier quoted context omitted.

GarageBand. iMovie. Both of which can have their projects opened in Logic Pro or Final Cut, an irreplaceable workflow for which there is no Android equivalent. Audio Bus. Not Google. For me, ARkit is huge for some hobby projects.

If Apple would sell me one of their dev phones that gives me root, I'd switch from Android in a second. I don't understand why this is such a big deal for them. They could even charge more for it, or make it so tech support is excluded from those phones, or whatever they need to do make money. They'd bring all the hackers back to their platform. Do you realize how much effort is spent on Android mods? Can you imagine…

Meh, there’s a small but dedicated community for mods, but they can affect system stability and that’s not a compromise Apple wants to make.

Not having root has never affected my almost ten year iOS dev career.

Re: Tethered Jailbreaks Are Back

#110

Post by randyrand »

heavyset_go wrote: post #46
rodgerd wrote: post #19

This will delight the one person in ten thousand who wants to jailbreak their own phone, and the border police in Australia (mandatory scans of phone required on demand), or China, or stalkerware retailers, or repair shops who like to rat around on customers' phones. Guess which will be the more common use?

You can already assume that states are sitting on exploits that they've found or bought, and that they can compel companies to provide some form of access via NSLs or secret courts.

only more advanced states.
Post reply on HN