JailbreakMe - It's out! (JB for iPhone 4/3GS iOS 4 & iPad iOS 3.2.1)

jailbreakme.com

5 points·ttol··5 comments

Elegant jailbreak. No computer required -- jailbreak from the device by visiting the website http://www.jailbreakme.com.

Open articleView on HN

This is a very elegant jailbreak. No computer required -- jailbreak from the device (currently supports iPhone 4, 3GS running iOS 4.0 or 4.0.1 and iPad 3.2.1)

1) Visit http://www.jailbreakme.com from your device.

2) Slide your finger.

2) Your device will be jailbroken. Cydia will be added to your home screen.

</notspam>

I'd like to know how this works, and it does indeed work. Using this method, couldn't any site install arbitrary software on an iPhone through Safari without the user knowing?

Yes. This is a massive security hole that Apple is sure to fix as soon as possible. I don't know if this jailbreak does it, but the old (iPhoneOS 1.1.1) jailbreakme.com not only exploited the TIFF vulnerability, but also patched it so it couldn't be used by anyone else. It would have been nice if they just offered an option to patch without jailbreaking though.

Fortunately, it's not just a copypasta Javascript exploit or anything of the sort - you have to actually know what you're doing in detail to modify this exploit to do what you want.

It uses a PDF exploit (yes malicious site could also use this). Currently MMS and Facetime is being broken for many people. I suggest waiting until the kinks are worked out.

This is pretty impressive. Installation through Safari (note that trying this with iCab resulted in no Cydia icon on the homescreen).

Backgrounder + Proswitcher (add http://rpetri.ch/repo as a source) = iPad multitasking awesomeness.

I'd also really like to know how they did this.

Reply on news.ycombinator.com