Checkm8 Exploit Opens Door to Unpatchable Jailbreak on iPhone 4S Through iPhone X

This can't be good for the security of these devices...

And have malware installed or spying on you. No thanks. Apple should have gotten their sh** together and not have had the exploit open for nearly a week.

This is a bootrom exploit. It can only be exploited when the device is in DFU recovery mode and will not affect the security of devices being used normally.

This is really the best kind of jailbreak exploit because only the people who really want to go out of their way to jailbreak can use it. Regular users are safe; all it means is that people can do whatever they like with these devices they own now.

All the cool kids violate their warranty. Didn't you know?

one restore on iTunes and your warranty is „restored“ so to speak

I haaaaaaate the new force press/haptic touch menu on iOS 13. I would consider jail breaking just to go back to how that worked on my X on iOS 12.

I haven't been jailbroken since the 3G, what's the big draw of a jailbreak now a days?

Good, now we can have proper downgrade rights on these devices. It's sad that something like this is needed to, for example, downgrade to iOS 10 on an iPad Air 2 for the simple purpose of running 32-bit apps.

Once the data is copied off the phone can't you brute force it without fear of being locked out? What's the encryption like?

You can read through the details yourself if you want: https://www.apple.com/business/docs/site/iOS_Security_Guide.pdf

The NAND itself is encrypted with AES 256. The passcode is the weak point, but to generate the AES 256 key from the passcode, you need the passcode and the unique AES 256 key burned into the Secure Enclave on the SOC. The passcode is run through PBKDF2 and then tangled with the AES 256 key in a one-way operation.

So dumping the flash raw means you face AES 256 at full strength, even if you know the passcode, because you also need the AES 256 key from the SOC to be able to recreate the key yourself if you aren't just brute forcing AES.

The fastest way to crack an iPhone is to brute force the passcode and bypass the lockout on attempts if you can. It also gives you the most access to the content.

Individual containers/files can be encrypted with separate keys based on the level of access the OS should have in different states of lock/unlock, on top of the NAND encryption. So if you dump the flash unencrypted, you then also need to crack the containers for things like email and messages which are also AES 256 encryption. All the more reason to focus even more on the passcode and attempt lockout mechanisms.

This is a bootROM exploit. Every iPhone ever manufactured excluding the iPhone XS and 11 series will always be vulnerable to this exploit regardless of any iOS updates. There is no patch.

Apple still manufactures the iPhone 8 and 3rd Gen Air. I wouldn't be surprised if we see manufacturing runs of those that include the patched boot ROM.

Is there anything exciting going on in the jailbreaking community anymore? Aside from using Apps you don't pay for, is there a reason to jailbreak anymore?

Yes. I have a dash/console integrated iPad Mini 2 in my 1981 DeLorean. It is connected via lightning cable to a Sony headunit installed in a cubby behind the seat. By using Sony's AppRemote app, I can control all stereo functions from the iPad itself. With the iPad being jailbroken, I can enable even more functionality---for example, I have Activator installed to automatically unlock the iPad when the iPad receives power (in other words, the key gets turned and the iPad gets unlocked). I also have it set to open the AppRemote software immediately after being unlocked. Little tweaks like this are nice to have and can only be obtained for me via jailbreaking.

This is great, it means people who want to do crazy things with their older iOS devices can jailbreak them to do so.

There's really no real world security threat; you have to go out of your way to do a bootrom exploit.

I reality, "regular users" are NOT safe. If your phone is ever stolen or lost someone will have physical access to your device and then is able to potentially access EVERYTHING on it. Or even if someone just has access to the phone for a little while, they could install spyware/malware and you would probably not know it.

This is a huge deal.

(Of course, the cynic will say, "ah ha, this will enable a huge replacement cycle...lol.)

They will still need your passcode to decrypt the key for the data partition on the phone. They won't have access to anything without your passcode. Apple has thought this stuff through.

Unless this can be used as a security exploit, I doubt anyone but the vast minority of iOS users will care.