'iBoot' leak may stem from low-level Apple engineer with ties to jailbreaking community

Posted:
in iOS
This week's publishing of the "iBoot" source code for iOS 9 can be traced back to a "low-level" Apple employee who shared it with a small group of jailbreaking friends -- and may not have wanted it to go beyond that circle, a report claimed on Friday.




The person was encouraged to use their inside access to help the friends out, Motherboard said. On top of iBoot, the employee is said to have taken additional code -- which has yet to be widely shared -- and distributed all of the material with a group of five people.

"He pulled everything, all sorts of Apple internal tools and whatnot," one friend noted.

Two of the friends said they hadn't planned on the stolen code leaving their group, but that it nevertheless ended up being shared more broadly and hence out of their control.

"I personally never wanted that code to see the light of day. Not out of greed but because of fear of the legal firestorm that would ensue," one person elaborated. "The Apple internal community is really full of curious kids and teens. I knew one day that if those kids got it they'd be dumb enough to push it to GitHub."

They argued that the initial group did its "damnedest" to make sure the code didn't leak until it was already old and less of a threat. Nevertheless, someone shared it with a person outside of the original circle a year after it was stolen, and it began spreading further and further during 2017.

The situation culminated with iBoot's appearance on GitHub. Apple subsequently issued a DMCA takedown, but downplayed the threat, saying that updated iPhones and iPads should be secure.

An anonymous Apple worker told Motherboard the company knew about the iBoot leak before it arrived on GitHub, but wouldn't say when it was discovered.
ronnairnerd
«1

Comments

  • Reply 1 of 39
    lkrupplkrupp Posts: 6,163member
    Well, my first question would be how could a “low-level” employee have clearance to access source code, the keys to the kingdom?
    edited February 9 Soliwonkothesanerandominternetpersonstevenozjony0
  • Reply 2 of 39
    "He pulled everything, all sorts of Apple internal tools and whatnot," one friend noted.
     I knew one day that if those kids got it they'd be dumb enough to push it to GitHub."
    Git would need to have a flag -pmij that would come with "git push origin". The flag would stand for "put me in jail"

    You can't just take away company's code (aka intellectual property potentially worth of billions) and put it out there like that. That is not just petty theft and will result in 10-20 years behind bars easily...and that is without counting the fees/fines and other things Apple will try to sue that person for.

    ronnmagman1979randominternetpersoncornchipstevenozjony0
  • Reply 3 of 39
    emig647emig647 Posts: 2,394member
    lkrupp said:
    Well, my first question would be how could a “low-level” employee have clearance to access source code, the keys to the kingdom?
    I believe they mean "low-level" software engineer. Someone that works on the lower level code close to the kernel.
    fastasleepdws-2magman1979Rayz2016cornchipviclauyycairnerdjony0
  • Reply 4 of 39
    maestro64maestro64 Posts: 4,166member
    lkrupp said:
    Well, my first question would be how could a “low-level” employee have clearance to access source code, the keys to the kingdom?

    Yeah that is the Billion $ questions, usually source code access is control to what subsystems you work on, only upper level people would have full access to all the code and code branches. There is more to this store which is not being told.
  • Reply 5 of 39
    foggyhillfoggyhill Posts: 4,721member
    maestro64 said:
    lkrupp said:
    Well, my first question would be how could a “low-level” employee have clearance to access source code, the keys to the kingdom?

    Yeah that is the Billion $ questions, usually source code access is control to what subsystems you work on, only upper level people would have full access to all the code and code branches. There is more to this store which is not being told.
    Low level here obviously means kernel, drivers, firmware , whatever... Has nothing to do with clearance.
    edited February 9 fastasleepStrangeDaysmagman1979Rayz2016randominternetpersoncornchipMacsplosionanton zuykovjony0
  • Reply 6 of 39
    "He pulled everything, all sorts of Apple internal tools and whatnot," one friend noted.
     I knew one day that if those kids got it they'd be dumb enough to push it to GitHub."
    Git would need to have a flag -pmij that would come with "git push origin". The flag would stand for "put me in jail"

    You can't just take away company's code (aka intellectual property potentially worth of billions) and put it out there like that. That is not just petty theft and will result in 10-20 years behind bars easily...and that is without counting the fees/fines and other things Apple will try to sue that person for.

    This person and their group of criminals should all face charges and massive financial penalties, plus Apple should take greater care in monitoring these few people who may also be selling critical software to competitors or spies.
    magman1979ksecairnerd
  • Reply 7 of 39
    Remember when people were clamoring for Apple to build their backdoorOS to get into the San Bernardino iPhone? Imagine that happening, and getting leaked by an idiot like this one.
    StrangeDaysmagman1979Rayz2016randominternetpersoncornchipviclauyycanton zuykovjony0
  • Reply 8 of 39
    SpamSandwich said:
    This person and their group of criminals should all face charges and massive financial penalties, plus Apple should take greater care in monitoring these few people who may also be selling critical software to competitors or spies.
    At the very least the guy AND the people he shared it with (who did not blow the whistle) should all be charged with grand theft, trafficking in stolen goods, etc.. That will hold them long enough to get more charges. Apple needs to land on them like a ton of bricks with both feet. They need to make it absolutely clear to everyone that it does not end well for anyone who leaks Apple Secrets. 
    mac_dogmagman1979SpamSandwichosmartormenajrrandominternetpersoncornchip
  • Reply 9 of 39
    SoliSoli Posts: 7,847member
    Remember when people were clamoring for Apple to build their backdoorOS to get into the San Bernardino iPhone? Imagine that happening, and getting leaked by an idiot like this one.
    I seem to recall that the Feds said they could keep it safe just to have some major loss of hacking software on a laptop, or something to that effect.
    magman1979
  • Reply 10 of 39
    Soli said:
    Remember when people were clamoring for Apple to build their backdoorOS to get into the San Bernardino iPhone? Imagine that happening, and getting leaked by an idiot like this one.
    I seem to recall that the Feds said they could keep it safe just to have some major loss of hacking software on a laptop, or something to that effect.
    You mean this? 

    Powerful NSA hacking tools have been revealed online
    https://www.washingtonpost.com/world/national-security/powerful-nsa-hacking-tools-have-been-revealed-online/2016/08/16/bce4f974-63c7-11e6-96c0-37533479f3f5_story.html
    Solimac_dogmagman1979anton zuykov
  • Reply 11 of 39
    thrangthrang Posts: 714member
    It still doesn't make any sense that the coding environment at this level is not fully isolated. There should be no way to move code from the site. Period. I work in the financial industry, and things are locked down to the point that you cannot access a working USB port to connect anything, and email/attachment access is insanely controlled or outright restricted. Every packet is sniffed. For a company like Apple, I would think the restrictions would/should be even greater. You cannot simply "have faith" people will do the right thing. How this was not firewalled (no email, no internet, no functional ports for external devices, etc.) is mystifying...This does not seem to a be the real story, and the premise of the theft and "quotes" seem downright silly...
    cornchipmuthuk_vanalingam
  • Reply 12 of 39
    bitmodbitmod Posts: 170member
    lkrupp said:
    Well, my first question would be how could a “low-level” employee have clearance to access source code, the keys to the kingdom?
    Because Apple orchestrated this story to force compliance on updating the software and purchasing phones capable of iOS 10

    kseccornchipmuthuk_vanalingam
  • Reply 13 of 39
    SoliSoli Posts: 7,847member
    thrang said:
    It still doesn't make any sense that the coding environment at this level is not fully isolated. There should be no way to move code from the site. Period. I work in the financial industry, and things are locked down to the point that you cannot access a working USB port to connect anything, and email/attachment access is insanely controlled or outright restricted. Every packet is sniffed. For a company like Apple, I would think the restrictions would/should be even greater. You cannot simply "have faith" people will do the right thing. How this was not firewalled (no email, no internet, no functional ports for external devices, etc.) is mystifying...This does not seem to a be the real story, and the premise of the theft and "quotes" seem downright silly…
    With as secretive as Apple is I find it mind boggling that someone was able to link pre-release SW on a server to a URL accessible to the outside world, but last year we saw this happen days before their announcement.
    fastasleepksec
  • Reply 14 of 39
    SoliSoli Posts: 7,847member
    Soli said:
    Remember when people were clamoring for Apple to build their backdoorOS to get into the San Bernardino iPhone? Imagine that happening, and getting leaked by an idiot like this one.
    I seem to recall that the Feds said they could keep it safe just to have some major loss of hacking software on a laptop, or something to that effect.
    You mean this? 

    Powerful NSA hacking tools have been revealed online
    https://www.washingtonpost.com/world/national-security/powerful-nsa-hacking-tools-have-been-revealed-online/2016/08/16/bce4f974-63c7-11e6-96c0-37533479f3f5_story.html
    That seems like it should be it, but upon reading the article there isn't enough data for me for say without a shadow of a doubt that's the specific incident I recall reading about. I'd lean heavily toward it being it since the timeframe and release seem to be on the mark.
    edited February 9
  • Reply 15 of 39
    bitmod said:
    lkrupp said:
    Well, my first question would be how could a “low-level” employee have clearance to access source code, the keys to the kingdom?
    Because Apple orchestrated this story to force compliance on updating the software and purchasing phones capable of iOS 10

    So, can you give me some of what you're smoking? Seems to be good stuff.
    magman1979cornchipDAalsethMacsplosion
  • Reply 16 of 39
    thrang said:
    It still doesn't make any sense that the coding environment at this level is not fully isolated. There should be no way to move code from the site. Period. I work in the financial industry, and things are locked down to the point that you cannot access a working USB port to connect anything, and email/attachment access is insanely controlled or outright restricted. Every packet is sniffed. For a company like Apple, I would think the restrictions would/should be even greater. You cannot simply "have faith" people will do the right thing. How this was not firewalled (no email, no internet, no functional ports for external devices, etc.) is mystifying...This does not seem to a be the real story, and the premise of the theft and "quotes" seem downright silly...
    It’s not quite that simple.  As an IT person (not a programmer) YouTube and the internet in general is a tremendous resource.  Companies might want to block YouTube (For example) to keep employees from wasting time, but it’s also an important resource.  GitHub is the equivalent for programmers...

    The problem is Apple should have noticed their code leaving the building (they have the resources to do so).  Basically you take a hash (fingerprint) of important files and monitor if that hash (file) goes out to an external IP address (leaves the building).

    The problem is we don’t know how the files left.  They weren’t directly uploaded to GitHub.  They might have been taken home on a corporate laptop (work from home or consultant scenario) or USB drive (which can be disabled).  Remember this was probably done by a proficient programmer... there is always a way.  It could have been by screenshots of code, then reconstructed as text/code.  You could encrypt the files, then send them by email (bypassing the file scanning).

    The point is there is no way to create a perfectly protected environment.  You can airgap (no network connections) the programmers machines and outlaw electronic devices in the building.  But we’re talking about software for connected mobile devices...  no work would get done.

    At some point you have to rely on NDA’s and an army of lawyers as a protective/deterrent, but people often don’t think about the consequences until it’s to late. 

    Basically things like this are inevitable.  The only good thing is it’s code from a few generations ago, and an army security specialists are going to be examining the code in hopes of getting the $200,000 bug bounty’s.  Hopefully they find most of the bugs before the bad guys do...
    edited February 9 randominternetpersoncornchip
  • Reply 17 of 39
    bitmod said:
    lkrupp said:
    Well, my first question would be how could a “low-level” employee have clearance to access source code, the keys to the kingdom?
    Because Apple orchestrated this story to force compliance on updating the software and purchasing phones capable of iOS 10

    I see the meds still aren’t working. 

    Got any, you know, evidence? 
    seanismorriswonkothesanecornchipmagman1979airnerd
  • Reply 18 of 39
    bitmod said:
    lkrupp said:
    Well, my first question would be how could a “low-level” employee have clearance to access source code, the keys to the kingdom?
    Because Apple orchestrated this story to force compliance on updating the software and purchasing phones capable of iOS 10

    Your post count is 130, and you're still being a lame-ass tin-foil hat troll?
    cornchip
  • Reply 19 of 39
    bitmod said:
    lkrupp said:
    Well, my first question would be how could a “low-level” employee have clearance to access source code, the keys to the kingdom?
    Because Apple orchestrated this story to force compliance on updating the software and purchasing phones capable of iOS 10

    Your post count is 130, and you're still being a lame-ass tin-foil hat troll?
    I think he missed the part where there is a high likelihood of shared code between between the different iOS versions.  Apple would have to run by blithering idiots to have that motivation.

    I do support the idea of having a tin-foil hat.  Someone really is out to get you, your data, your network, your computer (devices), your money, your dignity, your loyalty, your freedom, your worship, etc. etc.
    edited February 9 cornchip
  • Reply 20 of 39
    So there is a MOLE inside of Apple. This spy probably caused the recent security vulnerabilities with passwords on IOS. These mistakes are so basic, no experienced programmer should have caused them. They were deliberately introduced into IOS.
    cornchip
Sign In or Register to comment.