Hacker News Reader

Comment by pomfpomfpomf3 | Hacker News Reader

what? I haven't heard of a single jailbreak that worked like that. You got some links?

edit: to people linking me safari CVEs (can't reply to you all) - these are memory corruptions. Not accessing ports on localhost.

View on HN

Since no one has provided you with a link, here's one such approach: http://www.redmondpie.com/how-to-jailbreak-ios-9.3.3-using-s...

I think one of the first sites to do it was this one: https://jailbreakme.qoid.us/

Your first link appears to require the installation of an app on the phone (after installing a dev certificate). The app, running arbitrary native code, performs the actual jailbreak (most likely using a chain of kernel exploits).

The devs seem to have gotten around the App Store by using an approach like TestFlight, which allows apps to be deployed for development and wider testing purposes without going through the App Store.

jailbreakme took advantage of a Safari bug. All you needed to do was go to the website, hit a button and wait a few minutes.

That's a very different attack vector to the one in this post - buffer overflow vs legit service running on open ports unbeknownst to the user

I know one of the original iPhone and iPod Touch jailbreaks worked that way. I just went to a website and it automatically rooted and installed the homebrew app for me.

This write-up by CitizenLab [1] describes the Trident iOS exploit chain. Excerpt:

CVE-2016-4657 [2]: Visiting a maliciously crafted website may lead to arbitrary code execution

CVE-2016-4655 [3]: An application may be able to disclose kernel memory

CVE-2016-4656 [4]: An application may be able to execute arbitrary code with kernel privileges

[1] https://citizenlab.org/2016/08/million-dollar-dissident-ipho...

[2] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4657

[3] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4655

[4] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-4656

None of these exploits have anything to do with accessing TCP services using a browser. The only exploit there having anything to do with Safari, CVE-2016-4657, is a WebKit memory corruption (per your [1]: "The stage1 employs a previously undocumented memory corruption vulnerability in WebKit to execute this code within the context of the Safari browser (CVE-2016-4657).").

You're right, of course. I realised my mistake after the delete link had disappeared. My bad!

Reply on news.ycombinator.com