Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

https://www.macrumors.com/2019/08/19/ios-12-4-vulnerability-leads-to-jailbreak/

by dvcrn • 7 years ago

134 170 7 years ago

lol768• 7 years ago

A third security researcher, Stefan Esser said that people should be careful what apps they download from the App Store right now. "Any such app could have a copy of the jailbreak in it," he wrote on Twitter.

Seems a bit overblown when there's a review process in place. I'm sure it's not infallible, but still..

0x02• 7 years ago

It's happened before, and it's probably not super easy for Apple to do static binary analysis to determine if an app is going to make exactly the bad syscalls necessary for the jailbreak gated behind an undisclosed trigger functionality.

Flockster• 7 years ago

Can a review really check for this? Aren't there obfuscation methods and ways to delay the trigger of the exploit? It could wait for a special network package to start the exploit.

For iOS 9.3.3 there even was an app in the App Store, that could jailbreak your phone. (PG Client)

yots• 7 years ago

Yes, to some extent people should be worried about apps potentially containing exploits, but then again they should be more worried about 0-days than a known vulnerability.

oarsinsync• 7 years ago

A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to, or unaddressed by, those who should be interested in mitigating the vulnerability (including the vendor of the target software)[0]

Why should a publicly known unpatched vulnerability be a lesser concern than something that you don't know exists?

[0]https://en.wikipedia.org/wiki/Zero-day_(computing)

n1000• 7 years ago

Seems a bit overblown when there's a review process in place. I'm sure it's not infallible, but still..

Well, until now I assumed Apple would test for patched vulnerabilities in new iOS releases too.

dessant5• 7 years ago

It's unfortunate how Apple and Google approach device ownership, and their attitude towards the concept of general computing is concerning.

We do not control our own devices, we cannot stop certain processes on them, and we do not know where our personal data is sent.

We either have to flash ROMs from questionable sources and apply temporary exploits to get some kind of resemblance of control of our own devices, or we have to spend years to learn the skills to unlock these systems ourselves.

snaky• 7 years ago

Do you consider https://download.lineageos.org/ a questionable source?

dessant5• 7 years ago

I do not, but you have to be lucky enough to have a device that is supported by LineageOS, or you need to spend time learning the skills to build a custom ROM for your device.

Why isn't there an option in developer mode that gives us a root shell on our Android devices? Why is an escape hatch that gives back control to the user so frightening for these companies?

andreasley2• 7 years ago

I think Apple's approach is the only reasonable one for the general population. The technological complexity of any smartphone is far beyond comprehension for most people. I write iOS software for a living, and even with complete access to the source code, I couldn't reasonably evaluate my iPhone's software - let alone the hardware.

The idea that ROMs from questionable sources make your device safer sounds very strange to me.

Basically every electronic device has countless security issues. Some of them are found of which some are published of which most are eventually fixed (by rather large teams of professionals). In that regard, Apple could and should do better.

But the burden of making such a complex device secure simply can't be put on the end user.

While I would welcome deeper access for technically inclined people, I'm not sure that option can really be given by Apple/Google without the risk of becoming a disadvantage for many users.

thefz• 7 years ago

The technological complexity of any smartphone is far beyond comprehension for most people.

Don't use it then. By shielding the stupid we are creating more stupid.

r3bl2• 7 years ago

The idea that ROMs from questionable sources make your device safer sounds very strange to me.

It's about owning your hardware, not safety. A person that's willing to go through the hassle knows the consequences of such actions and how to deal with them.

Do "normal people" need to do that? Absolutely not. Should it be easy to do that? Absolutely not. But for those of us that really want to own our hardware, there should be a way of doing so without relying on exploits.

gpvos• 7 years ago

Well, they didn't say the ROMs made their device safer, just that they gave them some semblance of control.

dessant5• 7 years ago

I think locking down a system by default, but offering a way to gain elevated priviledges, while educating and properly warning users before certain actions is better than taking away everyone's control over their own devices, and therefore restricting their freedom.

solarkraft• 7 years ago

even with complete access to the source code, I couldn't reasonably evaluate my iPhone's software - let alone the hardware

That's not the point. The point is that the community will be able to do it and auditors' lives will be much easier, which benefits everyone because it vastly increases the likelihood of an issue being found.

The idea that ROMs from questionable sources make your device safer sounds very strange to me.

On Android by default most vendors ship a lot of bloatware and have demonstrated almost infinite incompetence or malice of both. While the developers "custom ROMs from questionable sources" (XDA forum threads) may not be experts in their fields at all and are quite likely to misconfigure the software possible creating some new holes, at least those images are compiled from open sources and are not the terrible manufacturer OS (I wouldn't onlike bank on stock Xiaomi software).

lloeki• 7 years ago

The idea that ROMs from questionable sources make your device safer sounds very strange to me.

The first step on Android is usually to unlock the device boot loader in order to flash a recovery that will allow to erase partitions and install a tarball of the system. I saw no tutorial suggesting to re-lock the device boot and I bet people rarely do it.

This means anyone can take the device, boot it into recovery, plug it into USB and throw some adb/fastboot commands to do anything they want. Device encryption becomes moot because neither the recovery nor the bootloader can be trusted.

kyle-rb2• 7 years ago

The technological complexity of any smartphone is far beyond comprehension for most people.

The exact same goes for regular computers and operating systems. And we still have those. Shouldn't we at least have the option on mobile?

pier257• 7 years ago

I think Apple's approach is the only reasonable one for the general population.

The general population uses macOS just fine.

rimliu• 7 years ago

There are things I want to control, and there are things I do not want to control. Smartphone is not a "general purpose computer" and I want just use it not to babysit it. And more often than not having "control over your own" device means that is is just some malware that has this control, not the user.

adrianN• 7 years ago

Your smartphone has all the hardware that it needs to be a general purpose computer. If you could plug in a decent screen and connect a mouse and a keyboard it would be more powerful than the computers you used just a few years ago.

onevu2• 7 years ago

It's fortunate I can buy an iphone for my mum and she hasn't had a single problem with it.

On the other hand I bought my dad a laptop with Windows and despite having an antivirus he's had all kinds of problems with it, including some heavy duty adware.

isostatic2• 7 years ago

Indeed, I wouldn't suggest anything other than a chromebook for my relatives

coldtea5• 7 years ago

Or, you know, buy something else.

Before the"locked devices, people had the inverse problem:

everything was two open ended and complicated, could cripple the system, stuff was open for exploit (much more so than in this case of unpatched vulnerability, viruses were everyday occurence). Techies didn't have this issue, but the general public did (heck, even techies did suffer somewhat). And that might have been OK for when the PC was an unconnected tool, but not when everybody has one with them, from school to nursing home, and everybody buys and does tons of sensitive stuff from it, while connected 24/7.

Whereas you can give a 2-year old an iPad, and they can start using it just fine...

DavideNL• 7 years ago

Whereas you can give a 2-year old an iPad, and they can start using it just fine...

What makes you think that if Apple would provide a mechanism in iOS, like SIP (System Integrity Protection) on macOS which can be disabled by technical users if needed, would change anything?

Right now, regular users do not disable SIP on macOS so there's no issue there. They don't even know/care that this possibility exists. So your 2 year old could still use the same iPad just fine.

bluescrn• 7 years ago

Give a child an iPad, and they’ll be bombarded with toxic advertising and apps wanting money, money, money.

Back in ‘the old days’ (80s+90s), a child with access to a computer was likely to learn something, even if their primary use of it was playing games.

realusername• 7 years ago

Whereas you can give a 2-year old an iPad, and they can start using it just fine...

That's because this new devices aren't "secure" but severely limited and crippled, you can't do much with them and they are far from actually usable like a computer. By that metric, my old Nokia was even more secured than an iPhone.

pier257• 7 years ago

everything was two open ended and complicated, could cripple the system, stuff was open for exploit

Maybe on Windows, but on macOS this has never been generally a problem.

globile2• 7 years ago

Don't forget about Telcos.

Your AT&T, Vodafone, Verizon & Co, put an enormous amount of pressure on Apple to limit and protect device unlocking.

This is a cat & mouse situation where either party might benefit from tight unlocking controls.

For example, MVNOs benefit from manufacturers with flexible and open unlocking policies that make it easy to unlock devices (without approval from the original operator), whereas long-term commitment contracts with traditional operators want to make it as hard as possible for you to leave with an unlocked device (regardless of whether you are legally entitled to or not - but that's a different story).

The economics of whether Apple would benefit from less strict unlocking policies (ignoring Telco's wishes) are not that clear.

You might think that unlocked devices would have longer lives, and therefore limit Apple's ability to push a new one to you, but you could also say that giving phones 2 or 3 different owners in their lifespans could help with app store purchases, limiting jailbreaking and possibly avoiding going with a newer less expensive android version.

Disclaimer: We unlock phones for MVNOs and individuals who get bullied around by their telcos.

Edit: Spelling

lotsofpulp• 7 years ago

Apple sells plenty of unlocked phones, all you have to do is buy it from Apple.

Lock restrictions only come into play if you want the mobile network to subsidize your phone.

Angostura2• 7 years ago

general computing

Apple does not consider phones devices for general computing and so prioritises stability, power consumption and security over flexibility and the ability to run arbitrary code. I'm happy with that trade-off.

jtbayly• 7 years ago

They clearly consider iPads general purpose computers, so we're back to the starting concern.

athrowaway3z• 7 years ago

This is such an unfathomably incoherent thought from an individuals perspective that i don't even know where to start.

Could you give your definition of 'general computing'?

papermachete5• 7 years ago

Steve Jobs said in his keynote of the very first iPhone, Apple have put a full-featured operating system on it, rather than a baby OS.

viraptor• 7 years ago

I'm not sure Google really belongs here. Telcos and some companies licensing Android - sure. But unlocking actual Google phones, like Pixel, is literally available from the menu in the developer settings. It's a well known/documented process.

dessant5• 7 years ago

That only unlocks the bootloader, which then allows you to install a custom one. There is no built-in option on Android for gaining elevated priviledges in any form, not even in a restricted way to disable bloatware that might compromise your privacy, and rooting your device breaks OTA updates, which also include security patches.

throwaway9d0291• 7 years ago

It does. Unlocking and gaining elevated privileges through rooting trips Google's SafetyNet API which will lock you out of many apps and/or features. It also breaks your device's Widevine certification so you can't watch DRM-protected video from many services.

As for the "We do not control our own devices, we cannot stop certain processes on them, and we do not know where our personal data is sent.", with stock Android provided by an OEM, you have no control over the opaque and invasive monolith that is Google Play Services and there's no way to control what data exits your device, aside from installing a VPN-based firewall. You can't even control when apps have access to your data, just a binary on/off switch.

zaroth8• 7 years ago

You can get a developer account, build and sign your own executables, and run whatever you want on your iPhone.

I don’t think those flashed ROMs give you appreciably more “control” over your iPhone than stock iOS provides, because actual control requires usable control surfaces. More likely, you are replacing the control surfaces provided by an accountable entity (Apple) who has prioritized your security and privacy and provides a constant stream of updates to maintain that, with what exactly?

The entire iOS feature set is designed to protect your personal data, from outside attackers who would seek to compromise it, to insider threats like apps trying to siphon off more than you might expect, to end-users inadvertently giving away their own (or your) data without a care in the world.

The security that a modern iPhone provides to its owner is truly a remarkable and commendable experience overall. I am extremely happy we as consumers have the choice to purchase exactly such a device.

readams• 7 years ago

The iOS feature set is intended to protect Apple's business model and revenue streams by forcing you to do things in Apple's jail. Getting a developer account is obviously an absurd and impractical approach to distribute software and proposing this is frankly ridiculous. It's not free, requires you own a Mac, and is way beyond the technical abilities of most users.

chmod775• 7 years ago

"You shouldn't be concerned about freedom because you're not gonna use it/need it anyways."

That's what your comment boils down to. You really want to go down that road of an argument? On a website that has hacker culture in its very name?

Wowfunhappy8• 7 years ago

You can get a developer account, build and sign your own executables, and run whatever you want on your iPhone.

Sure, for an extra $100 every single year. Apple charging money for a feature does not protect users.

kgwxd3• 7 years ago

You can run anything you want, but you can't not run anything you want.

zapzupnz• 7 years ago

Goodness me it gets tiring seeing a post like this every time an article about iOS comes up.

It's a legitimate point to make, but it should rather be that we talk about the content of the article rather than bring out the 'Apple's taking our freedom away' soapbox.

It inevitably turns into a debate between one side who values personal freedoms but won't be told to buy Android phones widespread safety, security, and privacy and tell the others to just buy Android phones.

This goes around and around, usually getting nobody anywhere, and happens all over again the next time an article about iOS turns up on the front page.

throwaway156503• 7 years ago

So let me ask, why make this comment? Why reply like this? To shut people's concerns down? There's no value here. There's nothing to be gained. Conversely, sometimes it's OK just to let people complain: without the sentiment, how do you know if people still care?

pathseeker• 7 years ago

It's an article about enabling a jailbreak and you are mad that people talk about jailbreaking needing to be a thing?

kgwxd3• 7 years ago

If a problem is presented, someone is going to bring up a solution. The right solution has been the same for a long time, Apple hasn't implemented it yet. Maybe they'll never implement it, but maybe someone will consider alternatives because of the comment.

dmos623• 7 years ago

Well there aren't any great alternatives. The state of general computing (as parent puts it) is frustrating, and people talk about it, sometimes by switching from a related topic. It's venting. Are there more productive ways of dealing with this? Maybe; but seemingly part of the frustration is that the average consumer feels powerless. Even your meta-post could be classed as a way to deal with this frustration. And, I wouldn't be so quick to dismiss venting as a waste of energy: it raises awareness, and in the right setting it can lead to discussions of the cause, and what could be done about it.

i_cant_speel• 7 years ago

Agreed. It gets very tiring. Every post related to Apple or Google devolves into the same exact conversations, regardless of the content of the article.

forgottenpass• 7 years ago

This goes around and around, usually getting nobody anywhere, and happens all over again the next time

A security regression in a new software release is a much older type of story that just gets talked in circles too.

it should rather be that we talk about the content of the article

iPhones are jailbreakable again. Whoop-de-doo. What are we supposed to say about it?

Might as well talk about the system design that makes owners of devices getting root on them considered a flaw in the first place.

mkane848• 7 years ago

For a second I thought I was in a thread about Windows

papermachete5• 7 years ago

I don't think that's so bad, makes the developer's job easier when there is just one version of your target. Nothing worse than entitled tinkerers.

stock_toaster• 7 years ago

No regression tests? ಠ_ಠ

mehrdadn5• 7 years ago

I mean... does every single patch need a regression test? If I did free(p); p[i] = 1; and then I fixed it by doing p[i] = 1; free(p); do I really need a regression test to trigger the dumb use-after-free I'd introduced?

reacweb• 7 years ago

I think the answer to your question is not obvious. Here, it would have prevented the problem of Apple. 12 years ago while working on a military project on sun, I have encountered a similar vulnerability caused by a regression https://blog.erratasec.com/2007/02/trivial-remote-solaris-0d...

Adding this kind of non regression test is costly, but it protects against source code management mistakes.

threeseed2• 7 years ago

It looks like a bad merge in which if there was a test it would've not been merged either.

m0xte• 7 years ago

(again). Goto fail comes to mind.

mehrdadn5• 7 years ago

I got a lot of flak here recently for suggesting that maybe security researchers shouldn't be publishing PoCs or deep vulnerability details literally 1 week after the vendor issues a patch.

Here's to hoping that, now that this happened, someone will give this idea another consideration...

(P.S. for those wondering: apparently this is CVE-2019-8605: https://bugs.chromium.org/p/project-zero/issues/detail?id=18...)

0x02• 7 years ago

But it's been 3 months since the vendor first issued a patch!

mehrdadn5• 7 years ago

I mean, I'm not suggesting 1 week should've been 1 month or even 3 months. Those are too short to me too.

But regardless, that's already 3 months people had to design, write, test, and perfect an exploit for it...

9HZZRfNlpR2• 7 years ago

Gives people opportunity to jailbreak their devices?

eljefe9003• 7 years ago

Please excuse the tinfoil hat - is there any chance that this vulnerability was reintroduced at the request of the Chinese government to allow easier access to Hong Kong protesters devices?

pilif3• 7 years ago

eljefe9003• 7 years ago

Apple has definitely accommodated the Chinese government’s desires before: https://9to5mac.com/2018/05/19/apple-cracking-down-on-callki...

UweSchmidt• 7 years ago

No need for a tinfoil hat or this specific vulnerability.

Any number of backdoors can be introduced with any update for any operating system or app. Generally governments around the world want backdoors and information from companies and companies generally comply.

pilif3• 7 years ago

Last time this happened to Apple they fought it tooth-and-nail and at least from what the public knows they were victorious and did not have to add a backdoor.

eljefe9003• 7 years ago

Cool! My first negative post. Maybe more context is valuable.

We know HKers are getting more and more tracking from the mainland government and are switching to applications not typically used for communication and organization. https://www.businessinsider.com/hong-kong-youth-using-tinder...

We also know that Apple has accommodated Chinese government requests to increase their ability to monitor communications: https://boingboing.net/2018/05/21/apple-bends-to-chinese-gov...

And as one of the most valuable companies in the world that ships software, it is surprising to see regressions in their software.

The article said that right now legitimate applications on the App Store could contain jailbreak code.

Of course these things are entirely possible to be unrelated, which is why I mentioned the tongue in cheek “tinfoil hat”.

The timeliness of the response from Apple in patching this reintroduced vulnerability should be swift. If so, I’m happy to step away from this position entirely.

nikisweeting• 7 years ago

I'm just thankful for a working jailbreak on the latest version with no "Please update your iOS beta version" popup. It's like a dream come true.

nathancahill• 7 years ago

Absolutely incredible to have a jailbreak on the latest signed version of iOS.

userbinator• 7 years ago

The saddest thing about this is the article presents jailbreaking as an entirely negative thing, while the comments offer a more balanced opinion.

auiya• 7 years ago

For most end-users it is. It allows any compromise of the device to elevate to root privileges.

pier257• 7 years ago

I've never understood why iOS isn't more like macOS. There aren't really any technical reasons why this couldn't be.

It's common for the security argument to be used to justify Apple's practices, but Mac users have been perfectly fine installing third party apps such as Transmit, Adobe Photoshop, or even Google Chrome from outside of Apple's walled garden. I've been using macOS since 2007 and I've never had a virus or any security problem, nor anyone else I know using a Mac. From my dev colleagues to my 70 year old mother in law or my 15 year old nephew.

It seems to me the only real arguments for Apple's walled garden are economical.

kgwxd3• 7 years ago

There will likely be a day when it's very difficult to install anything you want on macOS. Same with Windows. They keep trying really hard to make it happen but, for now, people keep pushing back even harder. For me, the fact that they're even trying is enough to leave.

TacticalTable4• 7 years ago

Market share is an appreciable concern here. Macs haven't been more than 20% of the market for a long time. iPhones are a much larger market share, especially among affluent users. I don't think we'd see any widespread viruses, but there would certainly be a ton of people losing their financial info from their own irresponsibility.

pier257• 7 years ago

So your argument is that because there are more users it needs to be more secure?

Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

Related Stories