Checkm8 Exploit Opens Door to Unpatchable Jailbreak on iPhone 4S Through iPhone X

A security researcher who goes by "axi0mX" on Twitter today released "checkm8," which he claims is a bootrom exploit for iOS devices equipped with A5 through A11 chips, including the iPhone 4S through iPhone X, several iPad models dating back to the iPad 2, and the fifth-generation iPod touch and later.

trio iphones ios
This would be the first publicly released bootrom exploit since the iPhone 4 in 2010 and pave the way for a permanent, non-patchable jailbreak on hundreds of millions of affected iOS devices. Since the bootrom is read-only, Apple cannot patch this type of exploit with a software update.


The bootrom exploit has many other possibilities on affected devices, including downgrading iOS versions without SHSH blobs or APTickets, dual booting iOS, and running custom firmwares, according to jailbreak enthusiasts.

This is significant news in the jailbreaking community, as the last bootrom exploit known as "limera1n" was released by George "geohot" Hotz nearly a decade ago for devices with A4 chips and earlier, including the iPhone 4, iPhone 3GS, the third- and fourth-generation iPod touch, and the original iPad.

Top Rated Comments

zorinlynx Avatar
60 months ago

This can't be good for the security of these devices...

And have malware installed or spying on you. No thanks. Apple should have gotten their sh** together and not have had the exploit open for nearly a week.
This is a bootrom exploit. It can only be exploited when the device is in DFU recovery mode and will not affect the security of devices being used normally.

This is really the best kind of jailbreak exploit because only the people who really want to go out of their way to jailbreak can use it. Regular users are safe; all it means is that people can do whatever they like with these devices they own now.
Score: 35 Votes (Like | Disagree)
itsmilo Avatar
60 months ago

All the cool kids violate their warranty. Didn't you know?
one restore on iTunes and your warranty is „restored“ so to speak
Score: 28 Votes (Like | Disagree)
tobefirst ⚽️ Avatar
60 months ago
I haaaaaaate the new force press/haptic touch menu on iOS 13. I would consider jail breaking just to go back to how that worked on my X on iOS 12.
Score: 16 Votes (Like | Disagree)
Jeremy1026 Avatar
60 months ago
I haven't been jailbroken since the 3G, what's the big draw of a jailbreak now a days?
Score: 15 Votes (Like | Disagree)
redheeler Avatar
60 months ago
Good, now we can have proper downgrade rights on these devices. It's sad that something like this is needed to, for example, downgrade to iOS 10 on an iPad Air 2 for the simple purpose of running 32-bit apps.
Score: 14 Votes (Like | Disagree)
Krevnik Avatar
60 months ago

Once the data is copied off the phone can't you brute force it without fear of being locked out? What's the encryption like?
You can read through the details yourself if you want: https://www.apple.com/business/docs/site/iOS_Security_Guide.pdf

The NAND itself is encrypted with AES 256. The passcode is the weak point, but to generate the AES 256 key from the passcode, you need the passcode and the unique AES 256 key burned into the Secure Enclave on the SOC. The passcode is run through PBKDF2 and then tangled with the AES 256 key in a one-way operation.

So dumping the flash raw means you face AES 256 at full strength, even if you know the passcode, because you also need the AES 256 key from the SOC to be able to recreate the key yourself if you aren't just brute forcing AES.

The fastest way to crack an iPhone is to brute force the passcode and bypass the lockout on attempts if you can. It also gives you the most access to the content.

Individual containers/files can be encrypted with separate keys based on the level of access the OS should have in different states of lock/unlock, on top of the NAND encryption. So if you dump the flash unencrypted, you then also need to crack the containers for things like email and messages which are also AES 256 encryption. All the more reason to focus even more on the passcode and attempt lockout mechanisms.


This is a bootROM exploit. Every iPhone ever manufactured excluding the iPhone XS and 11 series will always be vulnerable to this exploit regardless of any iOS updates. There is no patch.
Apple still manufactures the iPhone 8 and 3rd Gen Air. I wouldn't be surprised if we see manufacturing runs of those that include the patched boot ROM.
Score: 14 Votes (Like | Disagree)

Popular Stories

maxresdefault

Apple Announces 'Let Loose' Event on May 7 Amid Rumors of New iPads

Tuesday April 23, 2024 7:11 am PDT by
Apple has announced it will be holding a special event on Tuesday, May 7 at 7 a.m. Pacific Time (10 a.m. Eastern Time), with a live stream to be available on Apple.com and on YouTube as usual. The event invitation has a tagline of "Let Loose" and shows an artistic render of an Apple Pencil, suggesting that iPads will be a focus of the event. Subscribe to the MacRumors YouTube channel for more ...
Apple Vision Pro Dual Loop Band Orange Feature 2

Apple Cuts Vision Pro Shipments as Demand Falls 'Sharply Beyond Expectations'

Tuesday April 23, 2024 9:44 am PDT by
Apple has dropped the number of Vision Pro units that it plans to ship in 2024, going from an expected 700 to 800k units to just 400k to 450k units, according to Apple analyst Ming-Chi Kuo. Orders have been scaled back before the Vision Pro has launched in markets outside of the United States, which Kuo says is a sign that demand in the U.S. has "fallen sharply beyond expectations." As a...
iPad And Calculator App Feature

Apple Finally Plans to Release a Calculator App for iPad Later This Year

Tuesday April 23, 2024 9:08 am PDT by
Apple is finally planning a Calculator app for the iPad, over 14 years after launching the device, according to a source familiar with the matter. iPadOS 18 will include a built-in Calculator app for all iPad models that are compatible with the software update, which is expected to be unveiled during the opening keynote of Apple's annual developers conference WWDC on June 10. AppleInsider...
iOS 17 All New Features Thumb

iOS 17.5 Will Add These New Features to Your iPhone

Sunday April 21, 2024 3:00 am PDT by
The upcoming iOS 17.5 update for the iPhone includes only a few new user-facing features, but hidden code changes reveal some additional possibilities. Below, we have recapped everything new in the iOS 17.5 and iPadOS 17.5 beta so far. Web Distribution Starting with the second beta of iOS 17.5, eligible developers are able to distribute their iOS apps to iPhone users located in the EU...
Apple Silicon AI Optimized Feature Siri

Apple Releases Open Source AI Models That Run On-Device

Wednesday April 24, 2024 3:39 pm PDT by
Apple today released several open source large language models (LLMs) that are designed to run on-device rather than through cloud servers. Called OpenELM (Open-source Efficient Language Models), the LLMs are available on the Hugging Face Hub, a community for sharing AI code. As outlined in a white paper [PDF], there are eight total OpenELM models, four of which were pre-trained using the...