“Critical, top secret Apple code for the iPhone’s operating system was posted on Github, opening a new, dangerous avenue for hackers and jailbreakers to access the device, Motherboard reported,” Steve Dent reports for Engadget. “The code, known as ‘”iBoot,’ has since been pulled, but Apple may have confirmed it was the real deal when it issued a DMCA takedown to Github, as Twitter user @supersat noted [see below].”
“iBoot is the iOS code that ensures a secure boot by loading and checking that kernel is properly signed by Apple before running the OS,” Dent reports. “The version that was posted to Github, supposedly by a Twitter user named @q3hardcore, was for iOS 9, but much of it likely still exists in the latest version, iOS 11.”
“The code can’t be compiled because certain files are missing, but researchers and hackers who know what to look for could probe it for vulnerabilities,” Dent reports. “iPhones used to be relatively easy to jailbreak before Apple introduced the “secure enclave co-processor” with the TouchID of the iPhone 5s. Now, it’s nearly impossible for hackers to even find bugs in iOS code, making iOS exploits relatively rare, unlike in Windows and Android. As such, the iBoot leak is exposing code that hardly anyone has seen before. The iBoot dump first appeared last year on Reddit, but received little notice from the security community until it hit Github.”
Fun thing about the DMCA: it required Apple to state, under penalty of perjury, that the iBoot source code was legit: https://t.co/PKHZqcEe6h
— Karl (RIP ) (@supersat) February 8, 2018
Read more in the full article here.
MacDailyNews Take: Apple hacked so thoroughly as for some nefarious hacker(s) to get their hands on something as important as iBoot? Disaffected Apple employee(s)? Some other explanation for this massive, unprecedented leak?
SEE ALSO:
iOS source code leak could be the worst Apple’s ever had to deal with – February 8, 2018
Key iPhone source code gets posted online in ‘biggest leak in history’ – February 8, 2018
Apple’s iOS 12 could finally fix systemic frame rate issues and interface inconsistencies – January 30, 2018
Apple delays planned 2018 iOS features to focus on reliability, performance – January 30, 2018
Why Apple desperately needs a new Steve Jobs – January 29, 2018
At Tim Cook’s Apple, Steve Jobs is long gone, and so is the ‘it just works’ ethos – December 19, 2017
The Washington Post: ‘Why doesn’t Apple make its devices as carefully as it’s making Apple Park?’ – December 11, 2017
Apple Park estimated to cost upwards of $5 billion to build – December 9, 2017
What to do about Apple’s shameful Mac security flaw in macOS High Sierra – November 29, 2017
Apple started working on HomePod in 2012, so why are they so late to the smart speaker market? – November 21, 2017
Why Apple’s HomePod is three years behind Amazon’s Echo – November 21, 2017
Under ‘operations genius’ Tim Cook, product delays and other problems are no longer unusual for Apple – November 20, 2017
Apple delays HomePod release to early 2018 – November 17, 2017
Apple CEO Tim Cook: The ‘operations genius’ who never has enough products to sell at launch – October 23, 2017
Apple’s Mac Pro debacle: Failure and future – May 8, 2017
Why is Apple’s next-gen Mac Pro taking so long? – April 18, 2017
Apple’s desperate Mac Pro damage control message hints at a confused, divided company – April 6, 2017
Who has taken over at Apple? – April 5, 2017
Apple’s embarrassing Mac Pro mea culpa – April 4, 2017
Who’s going to buy a Mac Pro now? – April 4, 2017
Mac Pro: Why did it take Apple so long to wake up? – April 4, 2017
Apple sorry for what happened with the Mac Pro over the last 3+ years – namely, nothing – April 4, 2017
AirPods: MIA for the holidays; delayed product damages Apple’s credibility, stokes customer frustration – December 9, 2016
Lazy Apple. It’s not hard to imagine Steve Jobs asking, ‘What have you been doing for the last four years?’ – December 9, 2016
Apple is misplaying the hand Steve Jobs left them – November 30, 2016
Apple delays AirPod rollout – October 26, 2016
Apple delays release of watchOS 2 due to bug – September 16, 2015
Apple delays HomeKit launch until autumn – May 14, 2015
Open letter to Tim Cook: Apple needs to do better – January 5, 2015
Apple delays production of 12.9-inch ‘iPad Pro’ in face of overwhelming iPhone 6/Plus demand – October 9, 2014
Tim Cook’s mea culpa: iMac launch should have been postponed – April 24, 2013
Maybe Apple is admitting that Jailbreaking can be a rather good idea. Perhaps they’re seeing what people do with it before opening gates a little more. Or, perhaps they’re using this to use the jailbreak coder community for more ideas for iOS, lol. Devin Prater Assistive Technology Instructor
, Microsoft Outlook, Excel, Word, and Powerpoint instructor certified by World Services for the Blind
>
Part of a long-term scheme to “drain the swamp”? So might it be a White Hat or Black Hat operation? What if the code was used for nefarious purposes by a Black Hat embedded within Apple who I consider either neutral or a White Hat company. Perhaps this release forces Apple to redo the code so that it can no longer be used for some sort of anti-Social Justice purpose.
These are all possible but it’s likely simply a dumba§§ mistake.
We’ll see what Q says.
I have a biiiiig dongler
Further irony…
Jailbreaking wouldn’t exist if sideloading were available.
Sideloading is available on Android. Jailbreaking exists for Android.
Pay attention… I’m not going to repeat myself. Read it again.
What I don’t understand in all this is why github doesn’t have a system in place to vet and not publish things like this. And why they’re not in trouble for distributing stolen material, it makes no sense to me. To answer the MDN posit, this was clearly an inside job by someone who had access to the bootloader, but for some reason I don’t think this effects anything major. Obviously it’s bad for people running iOS 9, but there has to have been some knowledge about this prior to the DMCA strike by Apple simply by how iOS 11 changes the boot order, it double authenticates now and that’s something previous versions of iOS never did.
Another black eye. Let’s count the number of recent black eyes. Bad trend.
A biiiiiiig black dongler is always welcome
Github does have a system – it’s called honoring the DMCA takedown notice. That system is also the law.
If you went to a mall and bought drugs from another person walking through the mall, should the mall owner go to jail? Think how stupid that would be – the result would be either unbelievably heavy-handed rules controlling every tiny detail of behavior of everyone who is _NOT_ even doing anything wrong, or no more places open to the public. A better system is that people acting in a space are liable for their own behavior and not for a guest, unless they somehow affirm/claim the actions of that guest.
Same thing applies to websites with the current safe-harbor laws – they are not liable for infringing content unless they receive notice and refuse to take it down. That’s the law, and it’s better than the course of action you seem to be suggesting.
Your analogy is a little flawed. This person uploaded the content and advertised it, that would be like the drug dealer setting up a kiosk and the mall allowing them to do so while waiting for the DEA file a complaint to “comply”. What I’m suggesting is that sites like this should clearly have a system in place to at least monitor what their users upload, saying they have no responsibility because they’re just the “marketplace” and it’s the wronged parties responsibility to police the actions of others is nonsense. If everyone is responsible for their own actions, by your own argument, then github absolutely bears responsibility for being the host (you accidentally proved my argument.. oops)
You’re still missing the point. People discussing this very issue thought hard about the balance of required effort, and decided that it would create WAY too much friction to require hosts to evaluate everything before it goes live. It seems that you’re underestimating just how huge a job it would be to evaluate EVERYTHING on the Internet before it goes live. The web as we know it could not exist that way.
It’s more than effort. You’ve already highlighted the principle. Should Self Storage facilities check you belongings in case some bootleg DVDs exist? The user’s rights against unreasonable search supersede other’s rights to DMCA. Get a warrant and then have the authorities check.
Companies are NOT law enforcement. The Emperor only believes in the 4th Amendment as it applies to Apple’s interests.
No more than Apple being responsible for crimes committed involving the use of iPhones. Get real.
Pay back for not providing a back door?
This shows why having Apple write the code for a back door for the “good guys” is a REALLY bad idea. There is no possible way to keep it secure if something like this couldn’t be kept secure.