Slashdot Mirror
Browser-Based Jailbreak For iPhone 4 Released
WrongSizeGlass writes "Apple Insider is reporting on a browser-based 'jailbreak' for iPhone 4. Hackers on Sunday released the first 'jailbreak' for the iPhone 4, a browser-based exploit that allows users to run unauthorized code. Unlike previous jailbreaks, which required users to run software on their Mac or PC and tether their iPhone to their computer, the latest hack is done entirely within the Safari browser. Users simply visit the URL to begin the process, which modifies the iOS mobile operating system found on the iPhone, iPod touch and iPad. Some users have reported that the modification results in broken MMS and FaceTime functionality. This jailbreak does not work on iPads running iOS 3.2.1. "
This made the BBC news website front page - http://www.bbc.co.uk/news/technology-10836692
Now, just need a fix for iOS4 being slow and shit on the iPhone 3G....
http://lifehacker.com/5599406/disable-spotlight-searches-to-improve-iphone-3g-performance-on-ios-4
turn off the parts of spotlight you don't use
Like anyone can even know that
If a website can run unauthorized code by just visiting a page, does the jailbreak "innoculate" against the exploit it uses?
Or would apple's fix for the bug also break the jailbreak? (they'll do that, I guess).
Quidquid latine dictum sit, altum videtur
Isnt this a very large gaping security issue? I would assume its much worse than the Android one where you had to trick the user into installing a kernel module manually.
HTTP/1.1 400
You have a remote rootkit running from simply visiting a website?
Wasn't it just yesterday or the day before we called rooting your android (which has to be tethered), erasing your old operating system, and installing a new "custom" one with a rootkit installed on it which allows remote activiation of root an attack vector (note that even a rooted Android device can't get outside the Dalvik VM)?
I'm certain, absolutely certain that there will be no abuses of this. There will not be any nefarious person have a "must have" app that is so good that the app store refused and all you have to do are these easy steps right here on this web page! No, never happen - users would *never* be stupid enough to run things from a website - this is a great feature!
------- Sorry about the spelling, I suffer from two problems. Dyslexia makes it difficult to spell well, lazy makes it
This is a great step.
However, only if I can run linux or android on it, I might buy an iPad.
Yes, linux or andoid may not perform that well on this device (cpu and battery-wise), but the mere openness of these OSes is sufficient for me.
If Pandora's box is destined to be opened, *I* want to be the one to open it.
According to Appadvice, the problems have been fixed and even if you already used it to jailbreak your iDevice, it is easy to undo the damage:
http://appadvice.com/appnn/2010/08/jailbreakmecom-issues-resolved/
They also claim iOS 4 can be installed on an iPad! Has anyone verified this? Are there any downsides? (I'd love to get the "folders" working on mine).
I no longer login because I feel that while attacking a company's products is fair game (specifically Apple), having stories singling out their users as "selfish" and unkind is not "news for nerds stuff that matters". Am I an Apple fanboi? Let's just say I've used NIX for decades (yes I'm old) and I'm not talking OS X.
Just as a heads up to anyone thinking of buying and/or jailbreaking an iPhone 4, keep in mind that this is a userland jailbreak (like Spirit) and not a bootrom jailbreak like 24Kpwn. This is significant because this jailbreak only works on iOS versions with the vulnerable component, which means that Apple can and surely will patch it out in 4.1. This is also why Apple is signing their firmware: once they do release 4.1 they'll stop signing 4.0.x and it will be impossible to jailbreak new iPhone 4/3GSes as those devices will ship with 4.1 and it will be impossible to downgrade. Existing owners should be sure to backup their SHSH blobs using Cydia or Tiny Umbrella so that you can downgrade or reinstall 4.0.x in the future, otherwise you will be trapped just like new iPhone owners. 3G owners are also encouraged to backup their SHSH blobs, as Apple is soft-signing iOS 4.x on those devices (even though the hardware can't enforce it).
Anyhow, while I'm excited to see an iPhone 4 jailbreak, I'm a bit worried about the fact that it's another userland jailbreak. No one has successfully exploited the Apple bootrom since iBoot-359.3.2 was released last year, which is troubling. It's not possible to replicate the complete jailbreakability of the iPhone/3G without a bootrom exploit, and as iOS can quickly be updated to stamp out new userland exploits there's a distinct risk of the hackers running out of practical ways to jailbreak the platform through such limited means. Unless someone does find a new bootrom exploit, the "golden age" of jailbreaking has probably already sailed, and in the long run this is a very bad thing. The (practically) unhackable computer marches in on all fronts...
The Facetime and MMS issues were due to a permissions problem, which has already been sorted out, per planetbeing's Twitter feed.
Users simply visit the URL to begin the process, which modifies the iOS mobile operating system found on the iPhone, iPod touch and iPad.
This sounds like a huge security hole. If simply visiting a web page can modify the OS of the phone, then this can surely be used for more malicious purposes. Maybe the user has to make some more clicks but then how hard is it to social engineer a user into doing that, and the attacker can do anything they like. Such as installing back doors, keyloggers, whatever. This I think is more than just a jailbreak: this is a root exploit in the browser. Scary, to say the least.
The jailbreak itself may not work on other versions of iOS, but as it involves Safari I wouldn't be surprised if the root exploit itself works there as well. Binary patching of the running O/S (which is what I guess they are doing) of course works only against a specific version, minor revisions may break it, so no surprise it doesn't work for the iPad.
This is one I have to say I hope Apple plugs quickly. It just sounds too scary to me.
just tried that on my ipod (which is basically iphone 3g hardware), and loading the ipod-app still takes noticable time, rather then being instantanious in 3.1.3
i really regret upgrading the ios 4, the only added function i can find is threaded email (of which apple's implementation SUCKS), and i got a serious performance drop
People, what a bunch of bastards
Steve is already readying his police cronies to kick down some doors to stop this. And don't think some hippie court ruling is going to stand in Steve's way! He'll say this is malicious hacking.
SJW: Someone who has run out of real oppression, and has to fake it.
Sod loading anything, my 3G takes a noticeable period of time to react to UI inputs, screen rotations et al when it didn't under the previous OS. iOS4 sucks for the 3G, I don't know why Apple included it in the release.
Try doing a hard reset to the 3G phone x2. My wife's phone was unusable after the iOS4 update. This did the trick. It's worth a try.
Let's face it, most of us are scoffers. But moments before zero hour, it does not pay to take chances.
I just tried it too. I noticed a definite improvement in performance across all apps. The music app still takes forever to launch but it's better than it was with spotlight enabled. I don't think I've ever used spotlight on my iPod so disabling was a small price to pay for a bit of extra performance and probably better battery life.
I agree with everything you've said but your post makes it sound like disabling spotlight doesn't help at all which might discourage people from trying this hack.
this post is now diamonds!
hmm, i havent noticed serious input lag, just that safari doing loading wont respond at all to inputs, and apps like ipod-app hang for ~5 secs when you open them
i hope they fix it, if they dont however, i wont care all that much, in a few months my ancient symbian powered nokia will be replaced by a HTC android device, which will also make my ipod redundant
People, what a bunch of bastards
Meanwhile, everyone else using Palm, Blackberry, Windows Mobile, Android or Symbian devices, can keep being awesome. We don't have to jailbreak our phones to use them how we want to.
No man is an island, But if you take a bunch of dead guys and tie them together, they make a pretty good raft.
well, just played a bit more, and it looks like ipod-launchtime is down to ~1 second, still noticably slower then before the ios4 update (and in my opinion completely unacceptable for a device sold as a music player), but this does help.
Perhaps i'll try rebooting the thing as well..
People, what a bunch of bastards
We also need is a fix for people who try to install Windows 7 on their old 386 and complain when it won't work right. Oh wait, people don't do that.
If your hardware is two or more iterations out of date please don't complain if the latest OS isn't great on it. Either upgrade your device or downgrade your OS.
That said, a full restore and turning off spotlight completely helps quite a bit.
In typical fashion Slashdot is WAY late posting this story and the MMS/Facetime issues have long since been fixed. Anyone doing a new jailbreak will never see the issue as the jailbreakme.com site has been updated to correct it and anyone who already jailbroke and has the issue can simply go into Cydia and accept the automatic update and they will be fixed also. Again, THERE ARE NO LONGER ANY MMS/FACETIME ISSUES and there haven't been for almost 12 hours now. In fact they were fixed within an hour of being confirmed by Comex. It would be nice if Slashdot made the slightest attempt to make sure their stories are accurate, especially one of this magnitude.
I think its defiantly nice that you have the freedom to jailbreak the phone if you want. Now websites like this are legitimate and people with jailbroken Iphones don't have to hide them.
http://www.thetechnologygeek.org
I've been jailbreaking my iPhone since the beginning. I own the iPhone. I can do whatever I want to it. This is probably why the government has just officially stated that "it's legal" to jailbreak it. I'm just not sure about this browser-based jailbreak. I'm kinda scared that visiting a website can modify my OS on my phone. I actually hope Apple will fix this hole. I want the hackers out there to come up with an exploit similar to how Spirit jailbreaks the 3GS and prior.
Well, it's a good thing the government made all this legal....cause they definitely wouldn't have stopped me from jailbreaking MY OWN phone. Shit, I'll do what I want with any of my possessions. And this will always be the case. NO ONE will tell me what I can or can't do with my possessions.
Calm down. It came out yesterday, as far as I know. And some users have "reported that the modification results in broken MMS and FaceTime functionality" in the forums that I have seen. They are simply reporting what has happened. If it has been fixed that is great.
Disable the damn search junk you dont use anyways. IT sped my wifes 3G up a lot.
If there was one thing I wish the jailbreaking community would od is submit a patch to remove the useless search on the iphone.
Do not look at laser with remaining good eye.
Nokia has a phone where you don't need to jailbreak it, you have root access in the default OS and full control to even boot from different media into a different operating system. They are probably not the first and I definitely think it's a trend that will catch on if only because the phone DOESN'T CARE where your mp3 or movie comes from, that hot new app will not be blocked or delayed for arbitrary reasons and you don't have to buy crap shareware just to get something as trivial as a stopwatch app.
Most mobile phone companies don't really care about pushing some platform, they just want to sell phones. If a fully open platform is the cheap and easy way out that gives people the features that sell phones then that is the way they will go.
They included it so people would buy new hardware would be my guess.
I do...
iAds.
Do not look at laser with remaining good eye.
I'm terribly sorry, I thought Apple "Just Works". Turns out that's true with iOS 4 on the 3G, but in a different way.
If you're doing this and getting the purple background of death (just hangs and doesn't install) try this:
Method 1
-Click Home
-Double-click Home to bring up running apps
-Click and hold on Safari
-Close Safari, try again
Method 2
-Go to Settings->Safari
-Clear cache, history, cookies (some reported clearing History IN Safari to work)
-Try again
Method 3 (only thing that worked for me)
-Go to jailbreakme.modmyi.com instead of jailbreakme.com (just a mirror)
3GS 4.0.1
This IS news for those of us that were stuck on ios4 on a 3gs which had not previously been jailbroken. A carrier unlock is soon to follow, and given the fact I'm flying to Amsterdam this fall and want to use a prepaid sim while I'm there, this is BIG NEWS for me.
Ocean is land, covered with water.
To have the "cutting edge" people test out new features.
If this is just a URL couldn't a user be pointed to this unwittingly and there phone would have it's warranty nullified without the user having done anything?
America, Home of the Brave.
jailbreakme.com is a remote exploit, and that's much, much, MUCH nastier.
Now, just need a fix for iOS4 being slow and shit on the iPhone 3G....
Apple has already released a fix for this. It's called upgrading to an iPhone 4.
I can't figure out why people keep saying that is does not work on iOS 3.2.1 for iPad. I did it last night, and it worked perfectly. On top of that, it is also on the list of official supported devices and software versions.
I beg to differ, but my iOS 3.2.1 iPad was jailbroken within 10 minutes of the jailbreak release.
The blurb says this is a first, but I seem to recall maybe 3 years ago so on iphone OS 1.1.1ish was also jailbroken through the browser.. I don't recall all of the details but the URL was the same and i remember at the time watching a clip of Woz jailbreaking Kathy's iphone in the back of a limo with no PC software or tethering.
There is a video tutorial on cnet tv that shows you how to downgrade a 3G if you regret installing iOS4.
Do so at your own risk, YMMV, etc...
+1 Funny Signature
It seems like Apple is already looking at the problem.
yea... sure... lol
Now, just need a fix for iOS4 being slow and shit on the iPhone 3G....
There is a fix: upgrade the device. If you had done your research you would have known upfront the CPU in the 3g ( and 2g ) doesn't have the power needed. Only the 3Gs had the power of the existing devices.
---- Booth was a patriot ----
I don't know why Apple included it in the release.
Damned if you do, damned if you don't.
---- Booth was a patriot ----
This particular would have been stupid to put in on purpose though, considering it's a giant security hole just waiting for someone to exploit.
The iPhone 4 only became available three days ago. iOS 4 became available over a month ago. The iPhone 3G was only one generation behind the currently available model up until last week, and that was if you could even get your hands on one.
But it had to be rooted, which is 7331 slang for jailbreaking.
7331 = ... rooted, which is [noob / not elite] slang for jailbreaking.
I think you meant this instead:
But it had to be rooted, which is 1337 slang for jailbreaking.
1337 = ... rooted, which is [leet] slang for jailbreaking.
In which case you've proven yourself to be 7331.
-- 1337 5p34k 6r4mm4/2 ]\[4221?
I wonder what they added that slowed it down so much. Multitasking is disabled in the 3G. As far as I can tell the new version has added folders, desktop pictures and some minor changes to the email. Yet it feels considerably slower.
I'm with you on that one. I downloaded the iOS 4 since it was free and suppose to have new features. Well it's sluggish and I've seen a lot more crashes - but worst of all, the battery seems to drain a lot faster than it ever did before.
If I could downgrade easily to iOS 3 I would.
Try doing a hard reset to the 3G phone x2. My wife's phone was unusable after the iOS4 update. This did the trick. It's worth a try.
Count me in as somebody who had this work. It was still a little slower than 3.x, but it was usable again.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
Is there any way to get to a shell on iPhones? Does jail-breaking it let you install an app or ROM that will allow that. It would be nice to have root and be able to use a package manager or somthing like that. I just got one for work so I'm an iPhone noob.
"Unlike previous jailbreaks, which required users to run software on their Mac or PC and tether their iPhone to their computer, the latest hack is done entirely within the Safari browser."
I remember another jailbreak at least a coupe of years ago that also used a hole in mobile safari
"This jailbreak does not work on iPads running iOS 3.2.1."
really? it worked marvelously on mine, which came with 3.2.1
I had 4.0 running on my 3G for a couple or three weeks. I got tired of apps not starting up, extreme sluggishness, etc., so I ended up downgrading to 3.1.3. I enabled native multitasking (my phone is jailbroken), but it seemed to be less capable than the multitasking provided by Backgrounder. If I left a webpage or two open in Safari, odds were good that attempts to start other apps would fail. Even if I rebooted the phone, it'd take an interminably long time to open most apps. I had half a thought to have PwnageTool make an image with native multitasking disabled, but the final straw that sent me back to 3.1.3 was that 4.0 broke AirVideo's TV-out capability. The ability to group related apps together was nice (went from six or seven pages of apps down to just two), but iOS 4.0 caused too much other breakage for my taste.
20 January 2017: the End of an Error.
Bingo.
That's why it's also free, unlike the iOS 3 where Apple charge me to upgrade my ipod touch.
HUH?
If they said the OS would not work on Iphone 3G and Ipod TOuch 2nd gen or older, then that would have been a motivation for people to upgrade hardware. As it is now, you have people with devices that used to perform great are now performing like shit. Do you really think those people will want to spend on upgrading hardware thanks to getting "burned" by a shoddy OS upgrade?
I'm not happy with iOS 4.0 on my iPod touch (second generation), either. General UI sluggishness, sometimes to the point of making Mail react so slowly to the keyboard that it becomes unusable, and at that point the only way to get things back to normal is a reboot. There is some new functionality in Mail 4.0 but I don't use it. It appears that it is possible to downgrade back to 3.1.3; I'm going to try that next...
a government exploit, not surprisingly it's high tech. There are powerful lobbyists desperate to crush SME's
A factime/videophone revolution would spur economic growth around the world and they may well have a multi-pronged solution to stop that from happening.
Sorry to break the bad news!
Apple included it in the release because the fanboys carry on and on about how not every Android phone has 2.2 yet. Not doing so would blunt their biggest attack on Android. Besides this, wasn't the "Snappiness"* of the UI Apples only real selling point?
* Snappiness is an unquantifiable measurement, thus useless anyway.
Calling someone a "hater" only means you can not rationally rebut their argument.
Using Occams razor and common sense. Apple doesn't put these in, they just don't test it's products properly.
Never attribute to competence that which is easily explained by stupidity.
This hole will be closed in short order. Apple cannot abide you having control over your own phone.
Calling someone a "hater" only means you can not rationally rebut their argument.
woke up this morning at 6:45am. no power in the building, got bored. went to work. got to work. open slashdot. read about brilliant jailbreak solution for my 3gs with 4.0 on it which was vanilla pretty much since 4.0 was released. jailbreak after 5 seconds reading the article. jailbreak finished in minutes. so the rest of the day will be mostly about reinstalling cydia apps back. thanks slashdot for finding good use for my time.
mov ax,4c00h
int 21h
i figure apple is hoping to achieve a similar effect as in the windows-pc world, people keep installing updates and new stuff till their PC just slows down to the point of uselessness, they go out, and buy a new one.
I have to admit, if i were more of a mindless drone, i'd probably use my ipod's slothyness as an excuse to get an iphone 4 early (before my current contract is up), or to upgrade to a newer, more spacious ipod
As it is though, i'll not only kick my ipod to the curb when i can, but i'll get a high end android phone rather then an iphone, having a command line shell on my phone >> AWESOME
People, what a bunch of bastards
Pretty much, my GFs iphone 3GS impressed me so much last year that i got an ipod touch as a sort of PDA, then 4.0 came along and killed the responsiveness to the point where i will kick it out as soon as i get a decent android phone
People, what a bunch of bastards
Maybe this will help more:
http://lifehacker.com/5572003/how-to-downgrade-your-iphone-3g%5Bs%5D-from-ios-4-to-ios-313
Downgrade to 3.1.3
Like anyone can even know that