Slashdot Mirror
19-Year-Old Jailbreaks iPhone 7 In 24 Hours (vice.com)
An anonymous reader writes: 19-year-old hacker qwertyoruiop, aka Luca Todesco, jailbroke the new iPhone 7 just 24 hours after he got it, in what's the first known iPhone 7 jailbreak. Todesco tweeted a screenshot of a terminal where he has "root," alongside the message: "This is a jailbroken iPhone 7." He even has video proof of the jailbreak. Motherboard reports: "He also said that he could definitely submit the vulnerabilities he found to Apple, since they fall under the newly launched bug bounty, but he hasn't decided whether to do that yet. The hacker told me that he needs to polish the exploits a bit more to make the jailbreak 'smoother,' and that he is also planning to make this jailbreak work through the Safari browser just like the famous 'jailbreakme.com,' which allowed anyone to jailbreak their iPhone 4 just by clicking on a link." Apple responded to the news by saying, "Apple strongly cautions against installing any software that hacks iOS."
If only we could physically hack in a damn Micro SD slot.
"Apple strongly cautions against installing any software that hacks iOS."
I'm sure Apple have users' best interests at heart.
This guy does this every time a new version of iOS comes out and he never releases it publicly. For all we know it's been the same exploit all along.
What's the point of mentioning deceptive measures of time like this? It's not like this person started from scratch, decided to jailbreak an iPhone 7, and then 24 hours later was done.
The individual likely had an iOS jailbreak, which likely chained together a number of vulnerabilities and took some undisclosed amount of time to develop, and then tweaked / confirmed it on the new hardware. The 24-hour specification means nothing.
You are not alone. This is not normal. None of this is normal.
Lock him away and take all this data and hardware and when he submits the bugs to Apple, make Apple pay him the bounty and let him go with a nice clap on the back.
Well, or trust him not to sell the exploit to someone else or have it stolen. This must be worth a lot of money, much more when it is not submitted. People have been stolen from, killed or tortured for less.
Exploits are the new plutonium. You can prepare for war with stockpiling and weaponizing them.
Why report something that will end in your device being crippled? Fuckin' stupid
Mentioning the age does nothing for the story. It's completely irrelevant data.
You can easily side load a lot of stuff yourself using the free personal developer accounts. The apps expire after 30 days though so you have to keep re-adding it every month. I've got a couple apps on my phone that apple would never approve on the store, no jailbreaking.
It has USB over Lightning, so you COULD attach a micro SD reader, internal or stuck to the case.
If you wanted to be even more hackish, it shouldn't be hard to find some SPI pins. You can interface micro SD cards with four SPI pins plus power and ground. This guy provided root in the software in order to make the OS used the micro SD for whatever you choose.
Apple responded to the news by saying, "Apple strongly cautions against installing any software that hacks iOS."
Luca responded that it took "courage" to talk about his exploit and possibly withholding it from Apple.
can a 18 year old jail break an iPhone 6 in 71 hours?
-linux... they can't *give* that shit away.
Even better, Apple generally wants you to do this with apps with source code - the developers of f.lux tried it, but they released it as binary only and Apple called them out over it.
It's one of those things you really wish you could ask RMS about - a commercial closed-source OS that allows open-source to be loaded on, with enforcement of the "source" part - no releasing of binaries that may or may not match the source, but an OS that requires you to build the app from source code.
This demonstrates how full of security holes all our devices are.
Apple prides itself on security, yet even their products are like swiss cheese.
My eyes reflect the stars and a smile lights up my face.
I'm sure Apple have users' best interests at heart.
Thinking along pretty much the same lines as myself there.
"Apple strongly cautions against installing any software that hacks iOS."
"Well, they would, wouldn't they?"
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
At least their quote didn't include the illegal threat to void the warranty.
I had a sucky sig.
Or, develop your own app and distribute it using MacOS Server, MDM or VPP. You can even have your own app store in a enterprise environment with iOS. It's not as locked down as people believe. Just there are no public app stores other than Apple's own.
Daily reminder that RMS cares nothing for open source software; Stallman wants nothing to do with open source.
You can do that? I have MacOS server installed, can I just build an iOS app and put it on my kids ipads (for instance) alongside all their other apps?
Even better, Apple generally wants you to do this with apps with source code
Question. Does this require that you give Apple access to the code? If so, they are probably scanning it for "clever" solutions that they can either patch or use themself.
You don't need the source code -- you can simply sign a binary with your own dev credentials.
https://www.eff.org/https-everywhere
You can do that? I have MacOS server installed, can I just build an iOS app and put it on my kids ipads (for instance) alongside all their other apps?
Yes, that has been possible since the very beginning. In the old days, you had to mark those iPads as development devices and install a certificate. Now, Apple makes it extremely simple. Just plug the iPad into your dev machine.
I don't think RMS's position on this is obscure at all. Firstly he opposes the term "open source", secondly he strongly advises that people not use an unfree OS to begin with.
I was referring to two different options. USB over Lightning is one option.
As another, more hackish option the board surely has some SPI pins.
That said, because it is software-defined AND you have root, *perhaps* you could do SPI over Lightning. That's not what I was suggesting, though.
In a related report, another hacker has installed Linux on a Lenovo laptop that MS has had Lenovo lock down to prevent such a thing.
Not really. Yet, who cares?
Self-importance and self-indulgence is the root of ALL evil.
Or, just send a Profile to the device. No dev account needed. You can install and run your own enterprise apps remotely.