Breaker, breaker. Apple's iOS 12.4 update breaks jailbreak break, un-breaks the break. 10-4

File under: 'Breaking' news


iPhone hackers have discovered Apple's most recent iOS update, 12.4, released in July, accidentally reopened a code-execution vulnerability that was previously patched – a vulnerability that can be abused to jail-break iThings.

Pwn20wnd, the developer of the iPhone jail-breaking tool unc0ver, says the newest version of their software, 3.5.2, successfully exploits the SockPuppet flaw on iOS 12.4 to unlock a fully patched up-to-date device from the walled garden of Apple's App Store, thus allowing any third-party software, good and bad, to be installed and run.

The SockPuppet hole was found and reported to Apple in March by Googler Ned Williamson, and patched in May by the Cupertino giant with its iOS 12.2 release, locking out the jail-break tool. Then the iOS 12.4 release came along in late July, and broke that patch, allowing a slightly tweaked unc0ver to run as before.

So, basically, if you're using iOS 12.3 or 12.2, update to iOS 12.4, and jail break your handset, if you so wish, or go ahead right now if you're already running iOS 12.4. It's not generally recommended for security reasons, though; be aware of the risks and benefits before diving in.

Macbook 2015 keyboard. Pic: Apple

Google's Project Zero reveals Apple jailbreak exploit

READ MORE

"It was a wild ride... I was utterly unprepared for something like this," Pwn20wnd wrote. "I had to re-schedule almost everything to test this before release."

And why is this of any importance to those who don't jail-break their phones? The techniques used to jail-break handsets require some level of arbitrary code execution to succeed. It is understood government surveillance and phone unlocking tools can potentially use these types of code-execution flaws to carry out their snooping.

When an iOS update "breaks" a jail-break tool, it is usually because Apple has patched the vulnerability that was used to compromise the device. It seems that, in this case, one of those fixes has failed.

To put it another way, iOS 12.4, released on July 22, has apparently reopened an arbitrary code-execution flaw that Apple had previously patched as a security concern. And unc0ver, which can exploit that reopened hole, is open-source, so miscreants can find and reuse the exploit code needed to compromise a victim's device via the flaw. It is also worth noting that this is the first time in years that jail-breakers have had a working exploit for the latest, fully-patched version of iOS.

If you're not on 12.4, you should stay on 12.3, which is patched, and wait for 12.4.1 or whichever version fixes the hole again.

The Register has asked Apple for comment on the matter, and has yet to hear back at the time of publication. ®


Other stories you might like

  • Workers win vote to form first-ever US Apple Store union
    Results set to be ratified by labor board by end of the week

    Workers at an Apple Store in Towson, Maryland have voted to form a union, making them the first of the iGiant's retail staff to do so in the United States.

    Out of 110 eligible voters, 65 employees voted in support of unionization versus 33 who voted against it. The organizing committee, known as the Coalition of Organized Retail Employees (CORE), has now filed to certify the results with America's National Labor Relations Board. Members joining this first-ever US Apple Store union will be represented by the International Association of Machinists and Aerospace Workers (IAM).

    "I applaud the courage displayed by CORE members at the Apple store in Towson for achieving this historic victory," IAM's international president Robert Martinez Jr said in a statement on Saturday. "They made a huge sacrifice for thousands of Apple employees across the nation who had all eyes on this election."

    Continue reading
  • UK competition watchdog seeks to make mobile browsers, cloud gaming and payments more competitive
    Investigation could help end WebKit monoculture on iOS devices

    The United Kingdom's Competition and Markets Authority (CMA) on Friday said it intends to launch an investigation of Apple's and Google's market power with respect to mobile browsers and cloud gaming, and to take enforcement action against Google for its app store payment practices.

    "When it comes to how people use mobile phones, Apple and Google hold all the cards," said Andrea Coscelli, Chief Executive of the CMA, in a statement. "As good as many of their services and products are, their strong grip on mobile ecosystems allows them to shut out competitors, holding back the British tech sector and limiting choice."

    The decision to open a formal investigation follows the CMA's year-long study of the mobile ecosystem. The competition watchdog's findings have been published in a report that concludes Apple and Google have a duopoly that limits competition.

    Continue reading
  • Woman accused of killing boyfriend after tracking him down with Apple AirTag
    New meaning for accessory to murder

    A woman in the US has been charged with murder after she allegedly tracked down her boyfriend using an Apple AirTag and ran him over after seeing him with another lady.

    Gaylyn Morris, 26, found her partner Andre Smith, also 26, at Tilly’s Pub in an Indianapolis shopping mall with the help of the gadget in the early hours of June 3, it is claimed.

    A witness said Morris had driven up to him in the parking lot and inquired whether Smith was in the bar, stating she had a GPS tracker that showed he was inside, according to an affidavit [PDF] by Detective Gregory Shue. Morris, the witness said, subsequently spotted Smith within the establishment.

    Continue reading
  • How refactoring code in Safari's WebKit resurrected 'zombie' security bug
    Fixed in 2013, reinstated in 2016, exploited in the wild this year

    A security flaw in Apple's Safari web browser that was patched nine years ago was exploited in the wild again some months ago – a perfect example of a "zombie" vulnerability.

    That's a bug that's been patched, but for whatever reason can be abused all over again on up-to-date systems and devices – or a bug closely related to a patched one.

    In a write-up this month, Maddie Stone, a top researcher on Google's Project Zero team, shared details of a Safari vulnerability that folks realized in January this year was being exploited in the wild. This remote-code-execution flaw could be abused by a specially crafted website, for example, to run spyware on someone's device when viewed in their browser.

    Continue reading

Biting the hand that feeds IT © 1998–2022