Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Apple IOS 4.3.4 Jailbroken Hours After Update

CmdrTaco posted more than 3 years ago | from the give-us-the-option dept.

IOS 121

Stoobalou writes "The cat and mouse game between Apple and the jailbreaking community continues unabated as an updated version of PwnageTool hits the web just hours after apple updated its iOS mobile operating system to lock out the JailbreakMe PDF-based exploit."

cancel ×

121 comments

Sorry! There are no comments related to the filter you selected.

It's a drive-by download exploit (0, Troll)

engineerpop (2386170) | more than 3 years ago | (#36799128)

Here is a fixed title: Apple IOS 4.3.4 Drive-By Exploit Released Hours After Update

All a malicious person needs to do is make a porn site for iPhone and iPad users and use the PDF exploit to gain root. Then they can for example install a hidden app that calls and sends sms to premium rate numbers, or do anything else they desire with the device. But somehow this exploit gets turned as a great thing all while the same users are touting how secure their Apple products are.

Re:It's a drive-by download exploit (1)

Goaway (82658) | more than 3 years ago | (#36799160)

"The same users"? I'm sure you can provide an example of the same person saying those two things, yes?

Re:It's a drive-by download exploit (1, Insightful)

sgbett (739519) | more than 3 years ago | (#36799276)

I don't hold out much hope. His comment doesn't even make sense to anyone who has actually read the article. 100% troll.

Re:It's a drive-by download exploit (0, Troll)

Anonymous Coward | more than 3 years ago | (#36799422)

Spoken like a true Appleologist.
Take Jobs's cock out of your mouth when you speak to the big boys.

Re:It's a drive-by download exploit (-1, Offtopic)

Bloopie (991306) | more than 3 years ago | (#36799444)

And yet his comment will likely be modded up to +5, informative, by other mods who haven't read the article either and don't realize it has nothing to do with what he said.

Re:It's a drive-by download exploit (1)

gl4ss (559668) | more than 3 years ago | (#36799500)

yeah the new exploit is tethered only this time. so it only took apple couple of weeks(?) to fix the browser accessible hole.

Re:It's a drive-by download exploit (2)

tripleevenfall (1990004) | more than 3 years ago | (#36799442)

This is the internet... we normally don't require MLA citations for things that are more or less common sense.

Re:It's a drive-by download exploit (1, Insightful)

Goaway (82658) | more than 3 years ago | (#36799698)

Translation: "I never question things I want to be true, I just call them common sense instead."

Re:It's a drive-by download exploit (1)

jellomizer (103300) | more than 3 years ago | (#36800314)

That is the rule of the internet. Just remember about 1/2 of the population has below average intelligence.

Re:It's a drive-by download exploit (1)

JMJimmy (2036122) | more than 3 years ago | (#36800374)

100% of the internet population is over-opinionated and under-informed

Re:It's a drive-by download exploit (2)

isama (1537121) | more than 3 years ago | (#36800704)

That may be your opinion, but I think you should read some more.

Re:It's a drive-by download exploit (1)

UncleTogie (1004853) | more than 3 years ago | (#36801438)

I believe your premise is over-thought and overrated, and humbly suggest you collect more data before making said assumption.

Re:It's a drive-by download exploit (1)

Duradin (1261418) | more than 3 years ago | (#36799896)

Common sense is not common and what is touted as "common sense" rarely makes sense when scrutinized.

For example, any political campaign that runs with a core "common sense" message.

Re:It's a drive-by download exploit (1)

Anonymous Coward | more than 3 years ago | (#36800020)

It's common knowledge that common sense is usually wrong.

[citation needed] (1)

tepples (727027) | more than 3 years ago | (#36800294)

This is the internet... we normally don't require MLA citations for things that are more or less common sense.

But if something is contested, it'd be nice to have a URL or at least proper Google keywords to research the issue. Hence the "citation needed" meme that started at Wikipedia.

Re:It's a drive-by download exploit (2)

Samantha Wright (1324923) | more than 3 years ago | (#36799348)

When JailBreakMe 2 and 3 (the version that iOS 4.3.4 fixes being 3) were released, they came with a patch in Cydia [iphonehacks.com] to fix the underlying vulnerability. Not only are jailbreakers conscious of iOS's flaws, they're willing to clean up after themselves. The only people not protected against your drive-by hidden app are those smart enough to jailbreak but dumb enough not to patch, which is a fairly small market segment, because the usual "too-dumb-to-upgrade" population is replaced by the "click-yes-to-everything-iTunes-says" population.

Sorry, but even tried-and-true wisdom doesn't apply everywhere.

Re:It's a drive-by download exploit (2)

robmv (855035) | more than 3 years ago | (#36799478)

WRONG answer, all those users that do no jailbreak their iPhones (a lot of people) are vulnerable to this attack, those are not jailbreak possibilities, those are big security vulnerabilities that are used to jailbreak. I am pretty sure any other OS manufacturer bug like this will be called like they must be called "Security bugs" and not jailbreaks

Re:It's a drive-by download exploit (1)

Bert64 (520050) | more than 3 years ago | (#36799610)

However jailbreak users had a fix for this vulnerability available immediately right from the device itself, while non jailbreak users had to wait for Apple to provide one, and then must tether their device to a computer, download a large firmware file, reflash it and then restore all their settings to the device in order to be immune to the exploit.

Re:It's a drive-by download exploit (1)

PNutts (199112) | more than 3 years ago | (#36800186)

However jailbreak users had a fix for this vulnerability available immediately right from the device itself, while non jailbreak users had to wait for Apple to provide one, and then must tether their device to a computer, download a large firmware file, reflash it and then restore all their settings to the device in order to be immune to the exploit.

I don't let third parties patch my systems, at work or at home. But... Both tethering and the large firmware file are accurate but no longer true in iOS5 due possibly in September. The reflash and "restore" is currently handled by iTunes in one operation. I use the bunny ears for restore because I don't know the specifics, but the end user experience is to click "OK" when prompted to update and a bit later the phone is updated and ready for use. There is no separate restore.

Re:It's a drive-by download exploit (1)

dgatwood (11270) | more than 3 years ago | (#36800256)

Restore all your settings? Only if you jailbreak. Normally, the upgrade process does not involve any sort of restore....

Re:It's a drive-by download exploit (1)

node 3 (115640) | more than 3 years ago | (#36802232)

Um, what?

Steps you listed, for jailbreakers:

1. There is no step one.

Non-jailbreakers:

1. Wait for Apple
2. tether to computer
3. download a "large" file
4. reflash it
5. restore settings

You artificially expanded one set of steps, and collapsed the other. Why is that?

Re:It's a drive-by download exploit (4, Informative)

Anubis IV (1279820) | more than 3 years ago | (#36799468)

Here's a fixed title for you: Slashdot user fails at basic reading comprehension. It is NOT a drive-by-download exploit. The drive-by-download PDF vulnerability existed in 4.3.3 but was rapidly patched with the release of 4.3.4, and it has yet to be reopened as a viable exploit. Instead, what these hackers/developers/<your spin here> have managed to do is update their tethered means of jailbreaking to work with 4.3.4, but it currently requires being tethered to your computer with each and every reboot, otherwise you lose root. It's about as far from a drive-by-download as you can imagine and is not currently susceptible to malicious attacks unless you compromise physical access to your device. Now, pardon me while I tout how secure my Apple product is.

Re:It's a drive-by download exploit (1)

CheerfulMacFanboy (1900788) | more than 3 years ago | (#36799614)

Here's a fixed title: "engineerpop Too Stupid To Tell Difference Between Drive-By Exploit And Tethered Jailbreak"

Re:It's a drive-by download exploit (1)

RMingin (985478) | more than 3 years ago | (#36799750)

You're going to call and send SMS with an iPad? Good luck with that.

"Use premium data" maybe? Again I lawl, sir.

Re:It's a drive-by download exploit (1)

BitZtream (692029) | more than 3 years ago | (#36803876)

Considering mine iPad has cellular and a phone number, its not like its impossible.

Of course, I do actually send and make calls if for some reason my phone doesn't work, on my ipad ... but thats VoIP which is only brought into play if the closest landline is at least 48 hours away from me at best possible speed, but thats with another couple of non-builtin apps I've added.

Re:It's a drive-by download exploit (1)

RMingin (985478) | more than 3 years ago | (#36804118)

That's nice. My iPad 3G has been doing those things for over a year as well. Those are through apps, not natively. Unless the exploiters are writing and installing a custom baseband, they are NOT making premium SMS or premium calls from either of our iPads. I doubt AT&T would know what to do if you spoofed a data iPad's SIM and tried to make a call, they'd probably just drop the connection.

Re:It's a drive-by download exploit (1)

PNutts (199112) | more than 3 years ago | (#36800080)

Yes, I don't go to porn sites to look at the pictures. I read the (PDF) articles.

Re:It's a drive-by download exploit (1)

hairyfeet (841228) | more than 3 years ago | (#36802410)

Well anyone who has watched Pwn to own or read the article posted on OSNews on OSX [osnews.com] knows that security in the Apple camp as largely been a gift of security through obscurity which the incredible numbers put up by the iPhone and iPad killed pretty damned dead. Oh and before someone chimes in (as they always do) that they go after the Mac over the WinBox because the Mac is nicer? Protip: The first one to drop ANY machine gets $10,000 so risking that amount on trying to get a Macbook one could easily buy with the check would be dumb and those guys ain't dummies.

I'd say the real problem for Apple is they have both the white and black hats trying to crack them, the whites to jailbreak their iShiny while the blacks want to pwn the iShiny. Maybe they should take the whites out of the equation by offering a "void warranty and jailbreak now" button?

That would leave just the black hats which admittedly will be a MUCH harder problem, just look at how many years it took for MSFT to get Windows from the crazy 19 infections per 1000 boxes with WinXP to the 4 per 1000 with 7. They had to harden the OS with improvements to DEP, ASLR, process isolation, hell if that isn't enough for you you can do what I did with my customers and add Structured Exception Handling Overwrite Protection [microsoft.com] which works beautifully without any programs hanging.

But what Apple has ended up with is gonna be more than a bit of a puzzler, as the devices iOS runs on aren't really powerful enough to deal with the overhead of the above security features, yet people still expect to be able to install and run programs on the things like a laptop. Short of ripping out support for most functions and instead having everything go through Apple's servers in a thin client kind of way I just don't see how they are gonna stop the malware guys. The malware guys have seen the numbers of sales, have seen there is blood in the water, and now the sharks are coming wanting a bite. It doesn't help I've had conversation with Apple users that still believe the "Apple is immune to malware" meme, at least the Windows and Linux users see and accept the web is a dangerous place.

Perhaps the thin client model is the way to go for Apple. They certainly have the server capacity now and it would fit right in with their walled garden approach, the only question is would streaming everything client server style clog the networks worse than they are. Doesn't Opera already do this with their mobile browser BTW? Maybe taking a page from their book wouldn't be such a bad idea.

Realistically and unsurprisingly (1)

pinkushun (1467193) | more than 3 years ago | (#36799170)

Did you expect otherwise?

In the words of Stanley Jobson, from the film Swordfish, "Nothing is impossible."

Note: "There was an unknown error in the submission", constantly. I suspect you think this is spam, or the hamster in your wheel has died. so please let this post go through, comment system.

Re:Realistically and unsurprisingly (2, Informative)

MobileTatsu-NJG (946591) | more than 3 years ago | (#36799350)

Did you expect otherwise?

Yesterday Slashdot's summary said the last update was to prevent jailbreaking. The article said it was to fix the PDF vulnerability. So, yes, you might expect otherwise if you weren't terribly well informed on the topic.

Re:Realistically and unsurprisingly (3, Interesting)

rbrausse (1319883) | more than 3 years ago | (#36799446)

Note: "There was an unknown error in the submission", constantly. I suspect you think this is spam

nah, /. implemented Hotmails ban of common passwords [slashdot.org] and "swordfish" is on the list...

as a more serious remark: no, I didn't expect a different outcome of the update. It seems that Apple is way too exposed, the [add color]-hat scene has a new interesting opponent - it is boring to hit guys already lying on the ground. But Apple fights like hell to keep their secrets secret, obviously irresistible for hackers.

This reminds me of the PS3 debacle: The system was attacked after Sony removed the playground "other OS", I believe that a more open approach for iDevices (like store-independent software installation) would decrease the breaking attempts.

Re:Realistically and unsurprisingly (1)

ultranova (717540) | more than 3 years ago | (#36801588)

But Apple fights like hell to keep their secrets secret, obviously irresistible for hackers.

Apple doesn't fight to keep their secrets secret, it fights to sell you their iCake yet keep it too.

Frankly, it's about time this idiocy stops. In no other business can you sell someone a device, then charge for its use. And program industry with their "licensing" nonsense is even worse. Can't these creeps be dragged to the court and dealt with, so the industries can heal and start working according to the normal concepts of "buying" and "selling"?

This reminds me of the PS3 debacle: The system was attacked after Sony removed the playground "other OS", I believe that a more open approach for iDevices (like store-independent software installation) would decrease the breaking attempts.

"I am altering the deal. Pray I don't alter it any further." - Sony

Re:Realistically and unsurprisingly (1)

BasilBrush (643681) | more than 3 years ago | (#36801978)

Frankly, it's about time this idiocy stops. In no other business can you sell someone a device, then charge for its use.

I'm not sure what you mean. Assuming this isn't a general comment on charges for mobile phones... What charges for use?

Re:Realistically and unsurprisingly (1)

BitZtream (692029) | more than 3 years ago | (#36804042)

Frankly, it's about time this idiocy stops. In no other business can you sell someone a device, then charge for its use.

So at no point in your life have you ever seen a 'telephone' then have you? You buy the phone then pay to use it, its been that way since the government stepped in and stopped it from being you paid out the ass to lease a phone and out the ass to use it.

Re:Realistically and unsurprisingly (0)

Anonymous Coward | more than 3 years ago | (#36801792)

I thought the meme was "the impossible is nothing."

Re:Realistically and unsurprisingly (1)

jo_ham (604554) | more than 3 years ago | (#36803036)

Well, I expected a patch, but it wasn't to "stop jailbreaking" as much as slashdot would like to think so. It's not some machiavellian plot to thwart homebrew, but a patch to close a gaping security hole (you know, what Apple gets flamed for "not doing quickly enough").

Colour me unsurprised they patched a hole that allowed root escalation via the PDF handler. I would call that "due diligence", and would be lauded by slashdot if it were fixed by anyone except Apple.

Hah (-1)

Anonymous Coward | more than 3 years ago | (#36799182)

And people condemn me for wishing death on Steve Jobs when he perpetuates nonsense like this.

Re:Hah (2)

Goaway (82658) | more than 3 years ago | (#36799344)

You wish death on Steve Jobs for removing security holes in his products?

Re:Hah (3, Informative)

PopeRatzo (965947) | more than 3 years ago | (#36799578)

removing security holes

Is that what they're calling locking down a device these days?

By your logic, if the black helicopters showed up on your front lawn and hauled you and your family away to a detention camp they'd be "removing security holes".

In a way, you'd be right, too.

Remember what Ben Franklin said about security. If you're willing to give up your freedom for security, you don't deserve either. By Franklin's logic, Apple users deserve nada.

Re:Hah (1)

Reverand Dave (1959652) | more than 3 years ago | (#36799676)

>

Remember what Ben Franklin said about security. If you're willing to give up your freedom for security, you don't deserve either. By Franklin's logic, Apple users deserve nada.

I have always felt this way. "It just works" is a good way to describe the way the Burmese regime works. Of course it just works, there is not allowed to be any dissention among the ranks. If the large population of iDiots that purport to have superior products, security, etc ad nauseum actually looked at everything they were giving up just to have their comfy blanket of apple security, they'd be a little disappointed.

Re:Hah (2)

Goaway (82658) | more than 3 years ago | (#36799690)

Is that what they're calling locking down a device these days?

No, that is what we call removing arbitrary privileged code execution vulnerabilities in web browsers.

Re:Hah (1)

PNutts (199112) | more than 3 years ago | (#36800252)

Is that what they're calling locking down a device these days?

No, that is what we call removing arbitrary privileged code execution vulnerabilities in web browsers.

Definitely. It's the same thing Google did with Android in 2008. They patched an exploit that was also used to jailbreak phones.

Re:Hah (1)

Duradin (1261418) | more than 3 years ago | (#36799954)

/. should really have a macro for that quote as much as it gets used here.

Type BFQ and autoexpand from there.

Re:Hah (2)

shutdown -p now (807394) | more than 3 years ago | (#36804032)

The security hole was real, and could be used to run arbitrary code on your phone, not necessarily to give you control over it.

Nelson from "The Simpsons" (0)

Anonymous Coward | more than 3 years ago | (#36799200)

Haa haaa!

This is TETHERED (1)

Anonymous Coward | more than 3 years ago | (#36799210)

Tethered is much easier to do, and much less useful, since it requires re-doing it after every device reboot.

Dear hackers (4, Interesting)

Anonymous Coward | more than 3 years ago | (#36799246)

Thanks to your desire to run any software you wish, you're finding security holes for Apple, free of charge.

Keep up the good work.

Re:Dear hackers (-1)

Anonymous Coward | more than 3 years ago | (#36803062)

Hey, Steve Jobs. Quit crying. Your shit's been served.

Took /. longer to follow up (1)

Bob the Super Hamste (1152367) | more than 3 years ago | (#36799252)

Although it did take /. longer to have the follow up to this story [slashdot.org] .

Slashdot used to be run by technical editors (5, Informative)

Anonymous Coward | more than 3 years ago | (#36799256)

No, this isn't a new jailbreak. It's an existing exploit which uses the same hardware exploit found by Geohot MONTHS ago. The exploit install software is now configured for the new iOS version is all. This is why it's a TETHERED exploit, as the untethered exploit add-on no longer works in 4.3.4.

Is anyone technical even working at Slashdot anymore?

Re:Slashdot used to be run by technical editors (0)

Anonymous Coward | more than 3 years ago | (#36799576)

> Is anyone technical even working at Slashdot anymore?
Why should there? It's News For Nerds, not News For Geeks.

Re:Slashdot used to be run by technical editors (2)

DavidTC (10147) | more than 3 years ago | (#36800866)

No shit. The fact you used to be able to jailbreak your phone by visiting a website was not, in fact, a good thing. At all.

I'm against all sorts of restrictions on devices sold to people. I'd even argue we should make it illegal to restrict them that way, although for safety we should perhaps require some sort of protected reflash to jailbreak them, so normal consumers don't have to worry about viruses.

But, legally, people should be able to walk into an Apple store and demand root on their phone, and Apple would have to do it. And Apple should be able to demand you reflash back to unrooted before you get tech support with any software issue. That is my ideal world. Companies should not be allowed to keep control of devices they sell you. (Note this isn't the same as unlocking the phones, which I don't think they should have to do.)

And even in my ideal world, a website shouldn't be able to get root on an iPhone! Christ, people, think about that for a second. Of course Apple patched that.

Re:Slashdot used to be run by technical editors (1)

FirstNoel (113932) | more than 3 years ago | (#36800944)

Seconded...

When people can get "root" on your pc from you visiting a website....that's bad...

Why should your phone be any different?

Re:Slashdot used to be run by technical editors (1)

punit_r (1080185) | more than 3 years ago | (#36801172)

That is my ideal world. Companies should not be allowed to keep control of devices they sell you. (Note this isn't the same as unlocking the phones, which I don't think they should have to do.)

I'm curious. While you argue in favor of jailbreak as a right of the customers, you are not okay with unlock.

Why is it okay for a company to disallow use of a product with any network. Once the customer has paid for the phone, its his/her choice which network to use.

Re:Slashdot used to be run by technical editors (1)

DavidTC (10147) | more than 3 years ago | (#36804086)

I'm not in favor of unlock because while normal people pay the termination fee (And thus should have their phone unlock.), you apparently don't know about the actual reason for locking phones.

Specifically, people walking into AT&T stores with stolen credit cards, use that name, get an iPhone and a 'contract', and walking out and resell it.

I'm all for requiring the phone company to unlock any phone that you've actually paid off, either with time or a termination fee. The thing is, they already do that. In fact, they're required to by law.

Everyone who wants their phone unlocked without that either literally stole it from a warehouse, stole it by buying it with a stolen CC, gained it by claiming it was lost and got a replacement under warranty, or they fled their contract. (The last two are not, strictly speaking, theft...just fraud.) Or they purchased it from someone who did one of those things.

There's not some magical source of locked phones out there in legit hands that need unlocking. There are only two ways for people to legitimately need unlocking:

1) They purchased a replacement phone, and want to use their old phone on a different network, or

2) They bought, or were given, a phone from someone who paid it off, but before that person had it unlocked, so now the new owner can't prove it's paid off and the phone company won't unlock it.

There's several ways to solve these problem without allowing unlocking in general. The second can be solved with better bookkeeping, and I think the burden off proof should be on the phone company to demonstrate the phone isn't paid for yet, or otherwise unlock it.

And the first could be solved by letting people pay off the balance on their phone anytime they want, which would probably be good enough for most people.

Re:Slashdot used to be run by technical editors (1)

sjames (1099) | more than 3 years ago | (#36802258)

Why shouldn't they also have to unlock the phone? You're paying for it and the termination fees on a service contract assure you will pay for it even if you switch providers.

Re:Slashdot used to be run by technical editors (1)

DavidTC (10147) | more than 3 years ago | (#36803880)

Because people steal iPhones. They pay for their contract with a bogus credit card, walk out of the store, and resell them.

Re:Slashdot used to be run by technical editors (-1)

Anonymous Coward | more than 3 years ago | (#36802366)

Perhaps when Apple forces you to buy an iDevice, you may have a point. Until then, you opt into buying it, and you can certainly jailbrake it, but don't expect them to support your efforts or your hardware after the fact. Companies have been voiding warranties long before apple when it came to running a product out of specification. This is no different.

Oh wait. You probably don't even own an iDevice...

Re:Slashdot used to be run by technical editors (2)

StikyPad (445176) | more than 3 years ago | (#36803904)

The fact you used to be able to jailbreak your phone by visiting a website was not, in fact, a good thing.

Mostly true, however I might add that these exploits will almost inevitably exist as long as software originates with humans. I'm glad we're seeing them used for "good" with jailbreaks rather than for evil. Comex could easily have offered his services to the highest eastern European bidder instead of releasing a jailbreak (with the caveat that the jailbreak may well install a trojan horse for all I know.)

At any rate, IIRC "Jailbreakme" patches the exploit itself, essentially closing the door behind it on the way in. Functionality + responsibility is pretty cool as far as I'm concerned.

Re:Slashdot used to be run by technical editors (1)

ccguy (1116865) | more than 3 years ago | (#36801434)

Is anyone technical even working at Slashdot anymore?

Yes, but but we still don't RTFA.

Tethered jailbreak (5, Informative)

L4t3r4lu5 (1216702) | more than 3 years ago | (#36799264)

This jailbreak requires you to have your phone connected to your computer at every reboot in order to root it, and root is lost if phone is rebooted without connecting to the computer.

The PDF font handling vulnerability gave you perma-root (unthethered) and could also be used as a drive-by exploit.

In short, misleading title is misleading.

Re:Tethered jailbreak (2)

brim4brim (2343300) | more than 3 years ago | (#36799294)

But once you have root, why can't you just change that?

Re:Tethered jailbreak (1)

L4t3r4lu5 (1216702) | more than 3 years ago | (#36799396)

I may have misused the term "root", as I use an Android phone (rooted, obviously :) ). "Jailbreaking" iOS may not be the same as permaroot, hence not being called "rooting", and if that's the case it's my fault for using the improper term.

Re:Tethered jailbreak (2)

barzam (1808386) | more than 3 years ago | (#36799526)

The term "root" is to be understood as "administrator rights". So once you have opened the PDF or whatever your compromised phone downloads and installs another program that persists after the phone has rebooted. In turn, this program can keep sending those sms or log your data or whatever it does.

Re:Tethered jailbreak (0)

Anonymous Coward | more than 3 years ago | (#36800222)

Not necessarily... if the system partition is read-only & non-writeable (like it could be for certain Android models) then gaining root really can be a temporary compromise depending on the nature of the exploit.

Re:Tethered jailbreak (1)

tlhIngan (30335) | more than 3 years ago | (#36800744)

I may have misused the term "root", as I use an Android phone (rooted, obviously :) ). "Jailbreaking" iOS may not be the same as permaroot, hence not being called "rooting", and if that's the case it's my fault for using the improper term.

No, you're correct. Jailbreaking gives you root. It refers to breaking out of the jail() that iOS puts on apps, and as a side effect, also gives you root.

However, iOS has a few more security protections that make it harder to KEEP root. After all, Cydia and the like must run as root in order to work (Cydia relies on apt and debs, and grants full access to the system - something only doable via root as the iOS sandbox has limits).

You see, a vulnerability in iOS (and most other OSes) is that you can patch the in-memory images of stuff. Tethered jailbreaks rely on just that - patching the kernel images and such in memory, AFTER the security check has taken place. If you patch the kernel or other executables on disk, they will fail their signature checks and won't be loaded.

Re:Tethered jailbreak (0)

Anonymous Coward | more than 3 years ago | (#36802094)

Nope. There's a hardware-supported chain of trust that goes like that: bootrom->LLB->iBoot->kernelcache->userspace
bootrom is a ROM inside of the main CPU, everything else is potentially writable but sigchecked during boot; so far the only bootrom exploit found on A4 (limera1n) the DFU mode vulnerability, that needs the device to be manually booted in DFU mode using hardware buttons, and then a payload needs to be sent from the USB host (usually a PC). This vulnerability is not exploitable during normal boot path, so an 'untether' has to be used for that - a usermode app consisting of some way to avoid the userspace sigchecks, a privilege elevation exploit and a kernel code execution exploit that actually patches the kernel to allow unsigned code execution and w+x pages. Each new firmware release usually fixes vulnerabilities used by the publicly known untether.

Re:Tethered jailbreak (1)

Dunbal (464142) | more than 3 years ago | (#36799366)

How often do you reboot your phone? And don't you want to connect it to your computer after you do anyway, to restore stuff?

Re:Tethered jailbreak (1)

nabsltd (1313397) | more than 3 years ago | (#36799504)

How often do you reboot your phone? And don't you want to connect it to your computer after you do anyway, to restore stuff?

Why would you need to restore after a reboot?

I don't restart my phone (Android) that much, but sometimes an app dies and leaves the phone in a less than desirable state (e.g., un-killable background tasks that eat the battery). I've never lost any data because of a restart.

Re:Tethered jailbreak (1)

garaged (579941) | more than 3 years ago | (#36800058)

Samething with ipad, but it happens every 2-3 weeks, so it is not that anoying really, I updated to untether the jailbreak
Ast weekend after some 6 months running on tetherd jailbreak and I had rebooted at most 3 times in that ammount of time

BTW the update was showing on itunes since saturday at least, I had to do a partial upgrade because of that

Re:Tethered jailbreak (1)

dmacleod808 (729707) | more than 3 years ago | (#36799516)

Perhaps you misunderstand the meaning of reboot? I reboot my JB Ipad all the time (Bluefire reader crashed the ipad after JB, back to Stanza which wasnt working properly before the JB go figure) I have never had to restore anything after a "reboot"

Re:Tethered jailbreak (0)

Anonymous Coward | more than 3 years ago | (#36799552)

Ever since installing iOS 4, I've had to reboot my iPhone 3GS once or twice a week. Multitasking has killed performance on the phone as it doesn't have the RAM for it. After a few days of using different apps, it starts running dog slow. I'm usually on the bus or at work when it happens, so tethered reboots to my home computer aren't practical.

And no, you don't have to "restore stuff" after a simple reboot. If you were to wipe the flash memory clean, yes, but that's a factory reset, not a reboot.

Re:Tethered jailbreak (1)

frostfreek (647009) | more than 3 years ago | (#36800652)

Have you tried killing the unused apps instead of rebooting?
Just wondering...

Re:Tethered jailbreak (1)

Scoth (879800) | more than 3 years ago | (#36800920)

One of my big reasons for jailbreaking is installing Backgrounder and SwitcherMod to take over control of multitasking. I have it set to not background apps by default (except for a couple apps like Safari and ipod) and SwitcherMod to get rid of recently used apps in the switcher. That way it acts much more like a taskbar/dock of running apps rather than trying to hide which apps are running and which aren't. I'm smart enough to know the difference between running and not running and like being able to control what I leave running.

Re:Tethered jailbreak (1)

L4t3r4lu5 (1216702) | more than 3 years ago | (#36799886)

Rebooting in this instance (and all instances, AFAIK) means to power off and back on. This is not a destructive process (wiping, flashing, recovering etc). The temporary jailbreak for 4.3.4 does not persist through the phone being powered off and back on.

Re:Tethered jailbreak (1)

drinkypoo (153816) | more than 3 years ago | (#36800946)

You must be thinking of older Windows Mobile devices from the era just before flash got cheap. They have only enough nonvolatile storage to hold the operating system and a handful of apps...

the cheapest and best dvd boxset here (-1, Offtopic)

leo9188 (2386168) | more than 3 years ago | (#36799420)

We provide the cheapest and best dvd boxset here: http://www.dvdshopsonline.com/ [dvdshopsonline.com]

Re:Tethered jailbreak (1)

Jim Hall (2985) | more than 3 years ago | (#36803226)

> In short, misleading title is misleading.

And old meme is old.

This isn't relevant (0)

Anonymous Coward | more than 3 years ago | (#36799270)

They're using the hardware exploit, which requires changes to the hardware to fix, and requires you be tethered to perform it. Nothing new here, Seriously.

Re:This isn't relevant (1)

gumbi west (610122) | more than 3 years ago | (#36800266)

This basically means that they are out of software zero day exploits.

Having a walled garden is definitely responsible for Apple's high level of security.

Nothing Like Bragging Rights (1)

MikeyTheK (873329) | more than 3 years ago | (#36799290)

Is there anything that is quite as effective as bragging rights to drive innovation (besides Economics, of course)? I don't know if security on iOS could get any better faster if you didn't have a determined group trying to break it publicly.

all creatures great & small failing/disappeari (-1)

Anonymous Coward | more than 3 years ago | (#36799354)

there are exceptions? the unmentionable sociopath weapons peddlers are thriving in these times of worldwide sufferance? the royals? our self appointed murderous neogod rulers? all better than ok, thank..... us. their stipends/egos/disguises are secure, so we'll all be ok/not killed by mistaken changes in the MANufactured 'weather', or being one of the unchosen 'too many' of us, etc...?

truth telling & disarming are the only mathematically & spiritually correct options. read the teepeeleaks etchings. see you there?

diaperleaks group worldwide. thanks for your increasing awareness?

So it's a tethered jb... (1)

grimmjeeper (2301232) | more than 3 years ago | (#36799370)

The relevant question is: How many days until they come up with an untethered break? I give it no more than 2 weeks, tops.

Re:So it's a tethered jb... (0)

Anonymous Coward | more than 3 years ago | (#36799692)

I doubt someone will "waste" a undiscovered security bug for jailbreaking a .4 release that just fixed the jailbreaking hole - next tethered jailbreak will be with IOS5.

Re:So it's a tethered jb... (0)

Anonymous Coward | more than 3 years ago | (#36801514)

ios 5 will not be released until about the time the iphone 5 comes out early October. I can guarantee they will have an untethered jailbreak by early August.

Solution (0)

Anonymous Coward | more than 3 years ago | (#36799382)

Don't buy an iPhone.

Re:Solution (1)

compro01 (777531) | more than 3 years ago | (#36799536)

Or Android devices made by assholes (read: Motorola, etc.) who lock down the bootloader.

Instead of an iPod touch (1)

tepples (727027) | more than 3 years ago | (#36800418)

I didn't buy an iPhone. But what should I buy instead of an iPod touch? Samsung Galaxy Player didn't appear available last time I looked, and Archos devices don't have Android Market.

Re:Instead of an iPod touch (0)

Anonymous Coward | more than 3 years ago | (#36800680)

Archos devices don't have Android Market.

Pirate the market then. Just go to the Archos forums and you'll find tons of people telling you how to add the Market to your Archos device.

Or just pirate the apps. It works just as well, between APKTor and torrents. Hell, perhaps we'll see a return of the daily "new paid apps" torrents that used to occur.

A bit harder to get free apps, but you can always do both, and install ad blockers and crap as well.

It's the big advantage of Android after all - leave the app-paying chumps to iOS and the few that don't know about anything else other than paying for apps via the Market.

Why is this news? (0)

Anonymous Coward | more than 3 years ago | (#36799388)

Really? Why? Slow-news-day perhaps?

I sometimes wonder about the Apple programmers... (0)

Anonymous Coward | more than 3 years ago | (#36799916)

...who (try to) secure the iphone. They're obviously going to be clever people and very capable engineers, and even though it must be satisfying to solve these problems, I sometimes wonder if they ever have any qualms about working all day to deliberately limit the functionality of a really amazing bit of kit. All the best programmers I've worked with have that tinkering, hacker (in its original sense) mentality, and if I was in their position I'd probably be wondering about the overall worth of spending my time preventing users from accessing their own filesystem.

Then I'd shrug and think about my stock options to make myself feel better ;-p

Hey! (1)

Haedrian (1676506) | more than 3 years ago | (#36799968)

I guess "iOS 4.3.4 Prevents Hacking and Jailbreaking" wasn't true after all.

Re:Hey! (1)

PNutts (199112) | more than 3 years ago | (#36800306)

I guess "iOS 4.3.4 Prevents Hacking and Jailbreaking" wasn't true after all.

It was for about 12 hours...

not a new exploit (0)

Anonymous Coward | more than 3 years ago | (#36800110)

Correct title is. The same LimeRa1n exploiot that cannot be patched is still open.

WebOS (1)

SCHecklerX (229973) | more than 3 years ago | (#36800144)

It's a shame Sprint has abandoned the HPalm line. Hopefully it will gain traction on Verizon and ATT. No 'jailbreaking' necessary. The platform is open and easy to modify to your heart's content. HP actively recognizes, encourages, and works with the homebrew community.

http://www.webos-internals.org/wiki/Main_Page [webos-internals.org]

Apple did not push fix to break jailbreaking (3, Insightful)

SuperKendall (25149) | more than 3 years ago | (#36800778)

In two separate stories now, it has been put forth that Apple pushed out this fix with the mustache-twirling intent to stop jailbreaking.

Well obviously not, since the problem that lets tethered jailbreaking work is without issue. The REAL reason Apple "broke" untethered jailbreaking is that it was a gaping flaw in PDF handling that would let an attacker gain control of the system.

I realize Slashdot has a more general readership these days but surely anyone can see that leaving an exploit like that unlatched is bad. In fact other companies have been chastised for leaving holes like that open for too long, and rightfully so...

So please let us drop the pretense that every security patch is Apple out to stop jailbreaking. Apple in fact does not really care if you jailbreak, and is using it covertly to see what new features might be good to add to the platform by viewing the experimental jailbreak community... sometimes not so covertly as the case of them hiring the guy who did jailbroken notification handling to fix notification handling in iOS5! I can't think of a clearer signal that jailbreaking has at least covert approval within Apple.

Re:Apple did not push fix to break jailbreaking (1)

Strangelover (1889778) | more than 3 years ago | (#36801074)

I agree. Considering how easy it is to jailbreak ios devices and the original Apple TV, it seems obvious that that Apple puts little effort into blocking hacks that require physical access to the device. Obviously, with the film and music industry on board, they can't make an open device. But with this "cat and mouse" game, the mouse will never win, and any attempt the cat makes to win (completely lock down the device) is doomed to fail. Look at xbox, ps3 and WII. It's better to be the cat in a cat-and-mouse game than the hangman in a hangman game.

Re:Apple did not push fix to break jailbreaking (1)

drinkypoo (153816) | more than 3 years ago | (#36801408)

It's better to be the cat in a cat-and-mouse game than the hangman in a hangman game.

Seems to me like that depends largely upon your point of view...

I chortled a little (1)

Karl Cocknozzle (514413) | more than 3 years ago | (#36801018)

When I saw that the IOS 4.3.4 Un-jailbreakable! [slashdot.org] story was still on the front page when this came out. And remains there as of this writing.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>