Hacker cracks Apple's latest iPhone 3GS security measures

[AppleInsider]

A hacker this week released a new exploit that allows users to circumvent Apple's preventative measures that have blocked unauthorized code from being run on the new iPhone 3GS.

In October, Apple unexpectedly began shipping new iPhone 3GS models to ward off hackers who run unauthorized software in a practice known as "jailbreaking." In addition to unlocking the handset for use on other carriers, the practice can also be used to run unsigned code.

Hacker George Hotz this week released "blacksn0w," a combination jailbreak and unlock tool that works for the iPhone 3G and iPhone 3GS. The free software is noteworthy because it is the first known successful jailbreak and unlock for the iPhone 3GS with iPhone OS 3.1.2 and baseband 05.11.07.

Apple updated the BootROM for the iPhone 3GS to iBoot-359.32 in with a mid-cycle hardware release in October -- the first time ever that the handset maker had modified its hardware in the middle of a product line, without a new model released.

Hotz is a teenager who made headlines two years ago when he was the first to successfully unlock Apple's original iPhone all by himself. This summer, he also released the first jailbreaking tool for the iPhone 3GS.

Prior to the new BootROM, hackers relied on an exploit known as "24kpwn," which allowed users to run unauthorized code on the OS. But the latest update had prevented that exploit.

The latest hack for the newly updated iPhone 3GS hardware is not as seamless as some previous exploits. The blacksn0w software applies what is known as a "tethered jailbreak" for the October-and-later iPhone 3GS (and latest iPod touch), meaning users cannot perform a hardware reset of the phone without connecting it via USB cable to a computer. Users of an iPhone 3G or iPhone 3GS sold prior to the latest hardware upgrade are said to be able to restart without the tethered jailbreak.

Apple and the jailbreaking community, led by Hotz and a separate group of hackers known as the iPhone Dev Team, have gone back and forth for some time, as the Cupertino, Calif., company has looked to close avenues used by hackers. One of the main concerns about jailbreaking is piracy, as the procedure can allow users to steal software from the App Store.

[ View this article at AppleInsider.com ]

[infinite_entropy]

Can it enable iPhone tethering? If I had that, I'd be ridiculously happy, I could ditch my USB EVDO card!

[DonGus]

I love this cat and mouse game
And just like in Tommy & Jerry.... I love that the mouse keeps getting himself ahead :P

Originally Posted by AppleInsider

A hacker this week released a new exploit that allows users to circumvent Apple's preventative measures that have blocked unauthorized code from being run on the new iPhone 3GS.

In October, Apple unexpectedly began shipping new iPhone 3GS models to ward off hackers who run unauthorized software in a practice known as "jailbreaking." In addition to unlocking the handset for use on other carriers, the practice can also be used to run unsigned code.

Hacker George Hotz this week released "blacksn0w," a combination jailbreak and unlock tool that works for the iPhone 3G and iPhone 3GS. The free software is noteworthy because it is the first known successful jailbreak and unlock for the iPhone 3GS with iPhone OS 3.1.2 and baseband 05.11.07.

Apple updated the BootROM for the iPhone 3GS to iBoot-359.32 in with a mid-cycle hardware release in October -- the first time ever that the handset maker had modified its hardware in the middle of a product line, without a new model released.

Hotz is a teenager who made headlines two years ago when he was the first to successfully unlock Apple's original iPhone all by himself. This summer, he also released the first jailbreaking tool for the iPhone 3GS.

Prior to the new BootROM, hackers relied on an exploit known as "24kpwn," which allowed users to run unauthorized code on the OS. But the latest update had prevented that exploit.

The latest hack for the newly updated iPhone 3GS hardware is not as seamless as some previous exploits. The blacksn0w software applies what is known as a "tethered jailbreak" for the October-and-later iPhone 3GS (and latest iPod touch), meaning users cannot perform a hardware reset of the phone without connecting it via USB cable to a computer. Users of an iPhone 3G or iPhone 3GS sold prior to the latest hardware upgrade are said to be able to restart without the tethered jailbreak.

Apple and the jailbreaking community, led by Hotz and a separate group of hackers known as the iPhone Dev Team, have gone back and forth for some time, as the Cupertino, Calif., company has looked to close avenues used by hackers. One of the main concerns about jailbreaking is piracy, as the procedure can allow users to steal software from the App Store.

[ View this article at AppleInsider.com ]

[solipsism]

Very impressive work, Hotz.

You may not be doing too great with the ladies right now (assumption), but you’ll be wealthy and have your pick soon enough.


PS: Can someone get with Dev Team and have them name their PwnageTool app to reflect the version of iPhone OS it’s designed for, using a letter at the end to represent any point releases? For example, PwnageTool v3.1.2.c would be the third update to be used for iPhone OS v3.1.2.

[DonGus]

Originally Posted by infinite_entropy

Can it enable iPhone tethering? If I had that, I'd be ridiculously happy, I could ditch my USB EVDO card!

It is enabled... but you should load a customized ipcc from itunes to get the correct configurations for that. Just like you use to do in 3.0.

Just update the version inside the .plists on the .ipcc to a higher number (8.0 or something like that) so when you restore the ipcc it gets used as a newer version.

[solipsism]

Originally Posted by infinite_entropy

Can it enable iPhone tethering? If I had that, I'd be ridiculously happy, I could ditch my USB EVDO card!

Only if you can find not-so-simple tethering in Cydia or Icy. The elegant tethering by Apple started using signed profiles in v3.1 so even went jailbroken that option is out. I am still on v3.0.1 specifically for that reason. I don’t get the nifty iTunes-based Home Screen editing, but I can live with that.

PS: What is really lame is that even if you needed tethering while on WiFi because the machine you were using no longer had it (for whatever reason) you still won’t be able to use WiFi tethering until you can pay for carrier tethering.

[solipsism]

Originally Posted by DonGus

It is enabled... but you should load a customized ipcc from itunes to get the correct configurations for that. Just like you use to do in 3.0.

Just update the version inside the .plists on the .ipcc to a higher number (8.0 or something like that) so when you restore the ipcc it gets used as a newer version.

Do you have a link as to how to do that? All the data I’ve read says not to update to 3.1.x if you want to maintain tethering. I figure they’ll crack the profiles at some point, but I haven’t read that they’ve done it yet.

[infinite_entropy]

Co-worker pointed me to this: http://www.mobilecrunch.com/2009/11/...ning-os-3-1-2/

Trying it now, will report back!

[shavex]

One of the main concerns is piracy? From the App Store? I have been involved in the jailbreaking community for a while and I havent ever heard of such a thing! Apple just wants to control what you do and doesnt want you to buy from Cydia!

[solipsism]

Originally Posted by DonGus

It is enabled... but you should load a customized ipcc from itunes to get the correct configurations for that. Just like you use to do in 3.0.

Just update the version inside the .plists on the .ipcc to a higher number (8.0 or something like that) so when you restore the ipcc it gets used as a newer version.

Originally Posted by infinite_entropy

Co-worker pointed me to this: http://www.mobilecrunch.com/2009/11/...ning-os-3-1-2/

Trying it now, will report back!

I LOVE THIS KID! From the link above…

Blacksn0w still has its perks. Namely, it brings the aforementioned unauthorized data tethering right on back.

[DistortedLoop]

Originally Posted by solipsism

PS: Can someone get with Dev Team and have them name their PwnageTool app to reflect the version of iPhone OS it’s designed for, using a letter at the end to represent any point releases? For example, PwnageTool v3.1.2.c would be the third update to be used for iPhone OS v3.1.2.

It's a good suggestion, but why not tell them yourself?

The Dev-Team has a blog at http://blog.iphone-dev.org/ with an active and monitored comments section, and there are also several members who are active on Twitter (@MuscleNerd and @iphone_dev to start with).

[DistortedLoop]

Originally Posted by shavex

One of the main concerns is piracy? From the App Store? I have been involved in the jailbreaking community for a while and I havent ever heard of such a thing! Apple just wants to control what you do and doesnt want you to buy from Cydia!

There are multiple user-addable Cydia repos that offer up cracked iTunes App Store applications. It's a valid concern, and probably the most valid concern.

You must jailbreak to pirate, but you don't have to be a pirate to enjoy the many benefits of jailbreaking.

[solipsism]

Originally Posted by DistortedLoop

It's a good suggestion, but why not tell them yourself?

The Dev-Team has a blog at http://blog.iphone-dev.org/ with an active and monitored comments section, and there are also several members who are active on Twitter (@MuscleNerd and @iphone_dev to start with).

I have made my suggestion. Now I’ve made it here hoping that perhaps it will spark a reader who jailbreaks to offer it themselves, perhaps, but I shall never speak of it again.

[caljomac]

Hahaha. Another reason to buy an iPhone.

[infinite_entropy]

Okay, so this was the process:

Ran the app, unlock etc. went perfectly. Installed new carrier file.

Rebooted, took about FIVE MINUTES during which I was fairly frightened.

Started tethering thru my MacBook Air, was awesomeness, could even get calls while on 3G. SpeedTest said 1.25Mbps down, 0.20 Mbps up (acceptable for sure).

Problems: WiFi broken as in sees NO networks. Cannot receive calls properly when on EDGE. Basically except for tethering the device became less-than-usable for actually being mobile. Now restoring back to factory defaults. Total fail.

[adisor19]

Originally Posted by infinite_entropy

Can it enable iPhone tethering? If I had that, I'd be ridiculously happy, I could ditch my USB EVDO card!

Yup, it does enable tethering.

Adi

[DistortedLoop]

Originally Posted by solipsism

I have made my suggestion. Now I’ve made it here hoping that perhaps it will spark a reader who jailbreaks to offer it themselves, perhaps, but I shall never speak of it again.

I'll second your suggestion to them, but if they liked the idea, they'd probably have done it by now.

[Gazoobee]

Originally Posted by shavex

One of the main concerns is piracy? From the App Store? I have been involved in the jailbreaking community for a while and I havent ever heard of such a thing! Apple just wants to control what you do and doesnt want you to buy from Cydia!

This is total BS. You are either wilfully blind, don't care or are just pushing propaganda here.

On average about 30% of apps in use are stolen apps made possible by the two main websites anyone with a jail-broken iPhone visits although most developers don't check the numbers. The two high-profile development houses that *have* checked found that 95% of the people using their apps were using stolen copies.

Please go buy a fairy-tale book and read "The Goose with the Golden Eggs." It might be enlightening for you.

[Ireland]

Hacker.

[walkerdarin2003]

Originally Posted by infinite_entropy

Okay, so this was the process:

Ran the app, unlock etc. went perfectly. Installed new carrier file.

Rebooted, took about FIVE MINUTES during which I was fairly frightened.

Started tethering thru my MacBook Air, was awesomeness, could even get calls while on 3G. SpeedTest said 1.25Mbps down, 0.20 Mbps up (acceptable for sure).

Problems: WiFi broken as in sees NO networks. Cannot receive calls properly when on EDGE. Basically except for tethering the device became less-than-usable for actually being mobile. Now restoring back to factory defaults. Total fail.

It killed my wifi as well, I hope a fix comes out. I went ahead and restored till then.

[solipsism]

Originally Posted by Gazoobee

This is total BS. You are either wilfully blind, don't care or are just pushing propaganda here.

On average about 30% of apps in use are stolen apps made possible by the two main websites anyone with a jail-broken iPhone visits although most developers don't check the numbers. The two high-profile development houses that *have* checked found that 95% of the people using their apps were using stolen copies.

Please go buy a fairy-tale book and read "The Goose with the Golden Eggs." It might be enlightening for you.

I think one way to counter piracy is convenience. I’ve spent more in iPhone apps over the last 1.5 years than I may have ever spent in computer software in my entire life (never been a gamer). Part of that reason is the convenience of the getting the apps, but one app I felt was worth testing before I bought was the TomTom app at around $100. Turns out, I preferred my dedicated GPS, but if I had liked it, I may not have bothered with buying the legal copy. May have just forgotten about it altogether. i think Apple needs to use that exploding-DRM they use for movie rentals on their apps so trial periods of full apps can be had. If you exceed the trial period before completely removing it then you are charged for the app. I think they’d combat some of the piracy that, but maybe not.

[B747]

Originally Posted by infinite_entropy

Okay, so this was the process:

Ran the app, unlock etc. went perfectly. Installed new carrier file.

Rebooted, took about FIVE MINUTES during which I was fairly frightened.

Started tethering thru my MacBook Air, was awesomeness, could even get calls while on 3G. SpeedTest said 1.25Mbps down, 0.20 Mbps up (acceptable for sure).

Problems: WiFi broken as in sees NO networks. Cannot receive calls properly when on EDGE. Basically except for tethering the device became less-than-usable for actually being mobile. Now restoring back to factory defaults. Total fail.

From reading the iPhone Dev blog it seems to be a known issue. Try again and if WiFi is still greyed out then goto Settings -> Reset -> Reset Network Settings. That seems to fix it.

Sorry the path is probably incorrect but my iPhone was stolen on Saturday and I can't check it.

[DonGus]

Originally Posted by infinite_entropy

Okay, so this was the process:

Ran the app, unlock etc. went perfectly. Installed new carrier file.

Rebooted, took about FIVE MINUTES during which I was fairly frightened.

Started tethering thru my MacBook Air, was awesomeness, could even get calls while on 3G. SpeedTest said 1.25Mbps down, 0.20 Mbps up (acceptable for sure).

Problems: WiFi broken as in sees NO networks. Cannot receive calls properly when on EDGE. Basically except for tethering the device became less-than-usable for actually being mobile. Now restoring back to factory defaults. Total fail.

Well, that could be related to a lot of things. In my case the tethering works perfect, but I'm not using it throw the enabling process that came with blackra1n. I used blackra1n rc2 for jailbreak, but I didn't need the carrier unlock because my iPhone is from an authorized carrier. I get my phone by the normal procedure (buying to my carrier).

Now.... about the tethering.... in my case I enabled it using a patch for the commcenter.

The problems you comment I think are more related to the carrier unlock, than to the tethering enabling process. The problem is that with the RC3 both things came together (I think).

Maybe you should jailbreak only, and enable tethering without applying the BlackSn0w hack (AKA: enable it manually, modifying/patching the commcenter).

I used this guide:
http://www.iclarified.com/entry/index.php?enid=5634

Some friends says this one is easier (I didn't tested by myself):
http://iphoneate.com/activa-internet...one-3g-3gs-2g/

Anyway.... patching the commcenter is just half the work. The other half is to upload a custom ipcc with proper carrier configurations (that's what the commcenter patch allows.... to upload a custom ipcc without the proper signature).

Saludos!

[ghostface147]

Originally Posted by B747

my iPhone was stolen on Saturday and I can't check it.

That sucks dude...sorry.

[DistortedLoop]

Originally Posted by infinite_entropy

Problems: WiFi broken as in sees NO networks. Cannot receive calls properly when on EDGE. Basically except for tethering the device became less-than-usable for actually being mobile. Now restoring back to factory defaults. Total fail.

STOP! Don't factory restore. WiFi is a known temporary problem that GeoHot suggests can be fixed by going into settings on the iPhone and reseting your network settings...

[jb510]

Originally Posted by shavex

One of the main concerns is piracy? From the App Store? I have been involved in the jailbreaking community for a while and I havent ever heard of such a thing! Apple just wants to control what you do and doesnt want you to buy from Cydia!

Umm... really? Maybe you aren't really "involved in the jail breaking community" to the depth you think you are...

There is a HUGE pirate community for iPhone Apps. Primarily of games and the more expensive utility apps (like GPS apps). It is however heavily frowned upon by a good portion of the Jailbreak community, for example if you try to add the repositories to Cydia that specialize in pirated apps it'll warn/scold you but still let you do it.

There is another legitimate concern on Apple's part regarding cracks that allow execution of unsigned code like this, that being enabling malicious people to steal data off password locked/encrypted phones before they can be remote wiped.

What frankly continues to amaze me as much as the repeated cracks found by the JB community, is Apple's inability to truly secure a platform that they have total hardware AND software control over.

[NormM]

Originally Posted by Gazoobee

This is total BS. You are either wilfully blind, don't care or are just pushing propaganda here.

On average about 30% of apps in use are stolen apps made possible by the two main websites anyone with a jail-broken iPhone visits although most developers don't check the numbers. The two high-profile development houses that *have* checked found that 95% of the people using their apps were using stolen copies.

Please go buy a fairy-tale book and read "The Goose with the Golden Eggs." It might be enlightening for you.

Another point: some of the web sites for the pirated versions claim that people try the apps for free and pay for the ones they like. Some app developers who have apps that require communications with a server have monitored piracy rates. The statistics are basically that 0% of the pirated apps are ever paid for.

[B747]

Originally Posted by ghostface147

That sucks dude...sorry.

Thanks very much. Going to replace it on Friday as I feel lost without it!

[infinite_entropy]

So, I feel dumb now, seeing that the WiFi is a thing that's fixable, and that the no-calls-when-using-EDGE thing happens stock (having just done a restore).

Final verdict: this hack RULES! Going to use this. Re-doing it, and feeling kinda silly in the meantime

[DistortedLoop]

Originally Posted by jb510

What frankly continues to amaze me as much as the repeated cracks found by the JB community, is Apple's inability to truly secure a platform that they have total hardware AND software control over.

There isn't a computer system built that is 100% secure if physical access to the device is available. The iPhone has to communicate with iTunes over USB, this can be monitored, and subject to a man-in-the-middle type attack.

We could argue whether the iPhone is more or less secure than comparable devices, but to think that Apple's totally failed here may not be fair. That said, aren't they getting pretty close to cutting of jailbreaks for good? GeoHot has said that right now may be as as good as it gets for jailbreakers, which sounds like an admission that Apple's left very few holes left to exploit, and if Apple fixes the latest hack point of entry, there may be no others.

Originally Posted by NormM

Another point: some of the web sites for the pirated versions claim that people try the apps for free and pay for the ones they like. Some app developers who have apps that require communications with a server have monitored piracy rates. The statistics are basically that 0% of the pirated apps are ever paid for.

Age old arguments on those statistics, but I wonder how many of those apps would ever have been purchased to begin with, and how many of those apps are poorly written and would have been returned for refund if such a thing were allowed in the app store world. Low piracy conversion rates to paid for apps doesn't equate to anywhere near one to one for actual lost sales of the app in the first place.

[mdriftmeyer]

Originally Posted by solipsism

I think one way to counter piracy is convenience. I’ve spent more in iPhone apps over the last 1.5 years than I may have ever spent in computer software in my entire life (never been a gamer). Part of that reason is the convenience of the getting the apps, but one app I felt was worth testing before I bought was the TomTom app at around $100. Turns out, I preferred my dedicated GPS, but if I had liked it, I may not have bothered with buying the legal copy. May have just forgotten about it altogether. i think Apple needs to use that exploding-DRM they use for movie rentals on their apps so trial periods of full apps can be had. If you exceed the trial period before completely removing it then you are charged for the app. I think they’d combat some of the piracy that, but maybe not.

Either you're very young or you're admitting you've committed thievery for years and you wonder the reason behind folks not giving two bits whether or not your bitch about a bug in the OS or some application.

[samanjj]

Originally Posted by shavex

One of the main concerns is piracy? From the App Store? I have been involved in the jailbreaking community for a while and I havent ever heard of such a thing! Apple just wants to control what you do and doesnt want you to buy from Cydia!

piracy is common problem. a developer a friend of mine knows put a code in to know if the user had bought the app or not when posting high scores and most did not buy it.

[iNoodles]

I think a big part of the problem is Apples marketing/business plan in this situation. I JBed mine not for the pirated aspect of anything, I just wanted functions that are standard on a lot of phones (Such as having my to do list on my lock screen or being able to run the online radio and respond to a text message), and I do honestly believe that for every firmware/baseband update there will be a jailbreak, maybe it will take a little longer but there will be one. Anyone who has done even a basic fix on their computer knows that usually fixing a problem opens up another one that either you cant see or doesnt appear for some time. Its a bit like any of those cartoons where you see the character plugging a hole only to see another hole appear he plugs that one another one appears, he seals one to fix the other etc. I just cant see this platform being 100% secure ever, if the itunes update is completely sealed maybe well see it in a different format through wireless or another variant of connection.

What apple really needs to do is start acknowledging that there App store offerings are flawed and they need to hand more customization ability over to the user, and if the user doesnt want it fine, he can keep the standard apple "look". The other thing is that FanBoi or not, people, no corporation should control what you can and cannot do with your own property (yes I know but the cell phone company subsidizes it, yes your right but then I pay my highly overpriced bill, they subsidize it temporarily so to speak), apple needs to learn how to let go a little, im not asking them to open their platform completely but for FFS let me have an actual wall paper, not just one I see for the 3 seconds I unlock my phone.

Apple needs to find a middle ground and fast, maybe there isnt a direct threat on the horizon, some would say the Google Phones are but they have yet to "prove it". There is NO reason, that apple cant set some standards and use this marvelous piece of technology in the manner that satisfies the user the most.

Let me be fully honest, I told my friend straight up "Dont get an iPhone, I know you like to customize every aspect of your phone, you cant do that unless you JB which you might not be able to do now it" And ill continue to recommend that until apple understands that they will lose this battle in the long run when a competitor can offer the same thing but better and more user controlled, and they will, its inevitable thats the cycle of business.


*Edit* On piracy, pirates are scum. Thats one of the reasons that Apple needs to eliminate the NEED for JBing and Cydia.

[Postulant]

Originally Posted by walkerdarin2003

It killed my wifi as well, I hope a fix comes out. I went ahead and restored till then.

Interesting. It worked fine for me. Tethering worked great and my wifi is fine. Download Rock instead of Cydia...

[solipsism]

Originally Posted by mdriftmeyer

Either you're very young or you're admitting you've committed thievery for years and you wonder the reason behind folks not giving two bits whether or not your bitch about a bug in the OS or some application.

I guess that technically isn’t true and no, I’m not young, very or otherwise. I was counting all iTunes Store purchases, not just the apps, and not counting software that have come with purchased HW or the categories that I was considering to be more like “serviices” like ADC, which I have been spend $500 a year at.

I don’t use Adobe, Office or other expensive apps at home. i’ve used them in work environments where I wasn’t responsible for purchases and I’ve tested Betas, but that is it. So let me restate that, f you count the time since Apple moved to OS X, I believe I may have actually spent more money in iPhone apps in the past 1.5 years than I have in Mac OS X apps (not including the OS upgrades).

Note: I won’t lie and say that I’ve never stolen anything via the internet and have used my iPhone for tethering because AT&T doesn’t offer it. I use torrents for video that is otherwise not available to me. I don’t think it’s right, I don’t think I’m cool for doing it, but I’m mostly indifferent to it as there is no alternative means to which to pursue.

[Ireland]

Originally Posted by iNoodles

*Edit* On piracy, pirates are scum.

You're scum, and the scum you drove in on!

[hill60]

I saw someone the other day with a jailbroken iPhone, it had TomTom on it, they had gotten it for free.

Despite the nobility, blah, blah, blah of the jailbreaking community there are plenty of people around ready to exploit it.

Jailbreaking enables pirates, it's a simple fact of life.

Originally Posted by shavex

One of the main concerns is piracy? From the App Store? I have been involved in the jailbreaking community for a while and I havent ever heard of such a thing! Apple just wants to control what you do and doesnt want you to buy from Cydia!

[iNoodles]

Originally Posted by hill60

I saw someone the other day with a jailbroken iPhone, it had TomTom on it, they had gotten it for free.

Despite the nobility, blah, blah, blah of the jailbreaking community there are plenty of people around ready to exploit it.

Jailbreaking enables pirates, it's a simple fact of life.

With all due respect I disagree because your argument would suggest that if we JB we are pirates, I own no pirated software. Therefore you are incorrect. JB empowers the user to customize and utilize their phone in the manner they see most fit not Apple.

[hill60]

...and if that "customising and utilising" means that a person can install pirated Apps which can't be done on a non-jailbroken iPhone then the ultimate responsibility comes down to the people who make it become possible.

Congratulations your hobby enables pirates.

Congratulations your hobby threatens developers livelihoods.

Congratulations your hobby threatens one of the most successful business models of recent years.

Originally Posted by iNoodles

With all due respect I disagree because your argument would suggest that if we JB we are pirates, I own no pirated software. Therefore you are incorrect. JB empowers the user to customize and utilize their phone in the manner they see most fit not Apple.

[VinitaBoy]

"A hacker this week released a new exploit that allows users to circumvent Apple's preventative measures . . . ."

Not sure what is said here, because there's no such word as "preventative," just as there is no such verb as "preventate."

The word in play, I must assume, is "preventive." Oh, OK, now I know what the writer meant.