[ad_1]
For the first time in … well, for a long time … a jailbreak exists for the latest version of iOS!
The jailbreak is the time when you are exploiting a security breach, or more likely a whole series of security breaches, in what is essentially a carefully orchestrated cyber security attack, in order to free you from the attitude of the attacker. Apple vis-à-vis the iPhone.
Do you want to install your own applications? Do you want to change the locked system settings? Do you want to run network services such as SSH or even a small web server? Want to have the freedom to dive deeper into a running system that Apple will not allow you? Do you want to fix security vulnerabilities on old and unsupported devices?
Do you want to run the risk of getting into the unknown and accidentally putting your iDevice at a higher risk level than it was before?
Jailbreaking allows you to do all these things, usually voluntarily delaying the latest iOS updates, leaving as many open holes as you can while the jailbreaking community is trying to find ways to exploit them.
If you keep your iPhone up-to-date, you run the risk that by the time an exploit exploit has been discovered for version X, you are already on X + 2 or X + 7 and the exploit is no longer working.
And yes, it's a complicated irony that one of the often mentioned advantages of the jailbreak, that is to say that it means that you can fix the bugs as soon as you want without waiting for Apple, it is usually in deliberately avoiding patches that Apple has already released. .
Well, this time is different!
If you stick to iOS 12.3, for example, hoping for a jailbreak release, you'll have the unusual opportunity to upgrade to version 12.4 officially.
Apple hacker and jailbreak long time Pwn20wnd (the middle characters are the two digits) has just released an update of his famous project Undecimus, also known as never and touted as "the most advanced jailbreak tool."
For the moment, at least, you simply can not jailbreak iOS 12.3, although iOS 12.4 is open to jailbreak activities, and here's why.
Bear with us, because there is a metaphor to come.
Why are the bugs coming back
You go home on a bicycle, it's cold and wet, it's not too far, you already think lovingly electric heating in the bathroom (the hipsters do not use gas, remember? ); Suddenly, there is a whistle …
… and your tire deflates
You laboriously remove the offending wheel, remove the tire, find the hole, repair the tube (repair the hipsters rather than replace it, remember?), Put it back together, put it back in place, roll, feel like a performer!
You are colder and wetter than before, but speak with imagination to the grandchildren you have not yet, and say: "When I was young, we had to fend for ourselves …"; Suddenly, there is a whistle …
… and your tire deflates
Double taps are more common than you think and often occur for the simple reason that simply applying a patch may be the cause of another failure because it disrupts the status quo ante.
Perhaps you have treated the symptom (a hole) but you have not found the cause (a burst of glass in the tire), making another flat tire almost inevitable and soon?
Perhaps you have introduced a new foreign body, such as a stone or other burst of glass, while you had the tire out of the rim, making another puncture almost inevitable, and soon?
Maybe you have dislodged or disrupted a previous patch, misapplied when you were in a hurry the last time, making another apartment almost inevitable and soon?
Well, that's what just happened for Apple, metaphorically.
The SockPuppet exploit
In March 2019, a Google bug hunter, Ned Williamson, discovered and reported a bug, noted CVE-2019-8605, in the core code of Apple.
According to Google's Zero Project rules, the details of bugs reported in this manner are removed for 90 days or until a patch is widely available, giving the affected provider time to resolve the problem before the problem is resolved. bug is disclosed publicly.
The idea of the 90-day rule is that scammers are not allowed free access during patch preparation.
Nevertheless, sellers are still under real pressure to correct the security problems, but not enough to compel them to act hastily and perhaps to repent at their leisure.
Whatever the case may be, Apple has duly released patches in the demarcation line by posting macOS 10.14.4 and iOS 12.3 on May 13, 2019.
These updates addressed other security issues at the same time, but both operating systems received this hotfix:
CORE Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.4 Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Consequence: a malicious application might be able to run. arbitrary code with system privileges Description: a post-release usage problem has been resolved with improvement memory management. CVE-2019-8605: Ned Williamson working with Google Project Zero
On July 11, 2019, presumably thinking that the danger had passed, Williamson published a baptized exploit exploit marionette, a play on the fact that the bug exists in the low-level network code.
(In jargon, network connections are established between outletsand sockets are commonly referred to by the abbreviation sock in network code.)
This demonstration feat has been upgraded to a faster and more reliable version called SockPuppet2 July 22, 2019.
And that's where the history of puncture repair should have ended …
… Except that it seems that the latest update of Apple for iOS, version 12.4, has reintroduced the bug.
That Apple has dislodged the previous patch, introduced a new way to exploit the previous hole or corrected the symptom rather than the cause the last time is not yet known, but the bug is back.
Ironically, Apple's iOS 12.4 patch came out on July 22, 2019, the same day as the new improved SockPuppet2 demo code.
It was a coincidence, of course, but it ended up with problems for Apple because it made the last never jailbreak possible.
Apple now needs to release iOS 12.4.1 (let's assume it's what we'll call it) as soon as possible, not just because the company disapproves of the jailbreak and is doing its best for it. # 39; stop.
A hotfix hotfix is needed because there is now a known exploit and an open source jailbreaking toolkit that uses it, compared to the iOS version currently used by the majority of iPhone owners. .
What to do?
According to reports, the current jailbreak does not work on the latest iDevices.
Apparently, the devices using Apple's new A12 processor are not concerned – so you can relax – at least for now – if you have an iPhone XS, an iPhone XS Max, an iPhone XR, an iPad Mini (2019 ) or an iPad Air (2019).
The rest of us are vulnerable.
One obvious suggestion is "go back to 12.3", but there are two reasons not to do it: first, 12.4 has corrected many other potentially serious loopholes along with an accidental reactivation of SockPuppet; secondly, Apple will not let you do that.
Jailbreakers who already have a jailbroken device can use a variety of tricks to allow demotion, or more specifically to prevent Apple from disabling it, but those of us who are not long-term jailbreakers do not have luck.
Apple avoids downgrades as an anti-jailbreak measure or you can always hack your phone back to a version you know jailbroken, then back with the jailbreak installed.
Another suggestion is to jailbreak your own phone and then look for patches provided by the community to help you until Apple makes it to the update party.
We do not advise you to do this – if you are not already familiar with the jailbreak scene, then trying for the first time with a business phone or with a phone that you use regularly to manage your personal life will probably be a little too far.
In particular, we strongly recommend that you do not use some of the jailbreaking tips in online videos that promise a "jailbreak without a computer." These usually require you to install unauthorized applications built using unauthorized Apple Developer Certificates.
To our knowledge, your phone can not currently be jailbroken remotely. Therefore, crooks can not install this jailbreak as a "loophole" against your will.
They need physical access to your device, they need to know your unlock code, and they need to install a third-party application by adding a device management profile that you can locate later.
For now, the simplest advice is probably the safest: keep your lock code for you, do not let other people play with your phone and receive the next update from Apple as soon as it is released …
… which will probably be soon, so watch this space!
You can check the management of third-party devices by going to settings → General and looking for a menu item called Device Management. If this is the case, turn on the option to see who has been authorized to access your phone. If it is a business phone and it is registered in a mobile device management system such as Sophos Mobile Control, you will see one or more entries in the Management menu. machines. Ask your IT team to tell you what to expect if you see something suspicious.
LEARN MORE ABOUT JAILBREAKING AND ROOTING
We have recorded this Naked Security Live video to give you and your family non-technical advice to improve your online security, regardless of the type of phone you prefer.
Watch directly on YouTube if the video does not show up here.
[ad_2]
Source link