Tethered Jailbreaks Are Back

Post by justicz » Mon, Sep 30, 2019, 5:01 PM UTC

dguido wrote: post #102

justicz wrote: post #26

Earlier quoted context omitted.

Ha, I wonder if an attacker could use this bug to prevent or fake the rebooting process by changing the behavior of the lock/volume buttons when they’re held. I know there’s also a “hard reset” you can do with volume up -> volume down -> power, not sure if that works at a lower level.

Yes, an attacker using checkm8 could do that if they had a separate exploit for persistence. That exploit would be in iOS and take over at a later point in the boot process, and it would be possible for Apple to patch it with an iOS update. Those bugs are hard to find, but there have been dozens discovered in the past.

Post by saagarjha » Mon, Sep 30, 2019, 7:17 PM UTC

azinman2 wrote: post #98

dannyw wrote: post #90

Earlier quoted context omitted.

I feel like Apple employees shouldn't be using special iPhones for personal use (out of good engineering practice; nothing special.

Who else would be the best to test new phones, software and features, and understand how they may create bugs with 3rd party apps? In fact it’s critical to do so.

Post by wglb » Mon, Sep 30, 2019, 8:10 PM UTC

tptacek wrote: post #30

dguido wrote: post #12

Earlier quoted context omitted.

It certainly will _feel_ persistent if you're successfully attacked with this technique. If your iOS software is swapped out for a version with a backdoor, then the attacker will have collected your passwords and authentication tokens to services you use. If you reboot to clear the backdoor (and let's be honest: no one reboots their phones), then you won't also "clear" your attacker's memory of all your passwords.

I reboot my phone once in a blue moon, but my phone reboots itself roughly every other day (usually because I space on charging it). Am I that unusual, or is "the phone is rarely going to reboot" not really a reliable predicate for attackers?

Post by saagarjha » Mon, Sep 30, 2019, 9:34 PM UTC

moftz wrote: post #100

Mindwipe wrote: post #95

Earlier quoted context omitted.

Jailbroken devices can attack application logic to cheat in multiplayer games, somewhat attack DRM systems for video content (though Fairplay isn't especially vulnerable here), gain access to chargeable features without paying for them (decompiled Spotify APKs that do not feature advertising without having to pay exist on Android and are a non-trivial revenue risk) etc etc. In more open systems you are usually more a…

Piracy for Android doesn't require a jailbroken/rooted device.

Post by willstrafach » Tue, Oct 01, 2019, 2:10 AM UTC

justicz wrote: post #111

dguido wrote: post #102

Earlier quoted context omitted.

Yes, an attacker using checkm8 could do that if they had a separate exploit for persistence. That exploit would be in iOS and take over at a later point in the boot process, and it would be possible for Apple to patch it with an iOS update. Those bugs are hard to find, but there have been dozens discovered in the past.

I’m a little confused, which part of my comment would require persistence? I was suggesting a lulzy payload that would prevent the user from _actually_ restarting their device by changing the behavior of the power button. As a means of bypassing the “just restart your phone every time you use it” countermeasure.