Skip to Content

Jailbreakme site utilizes PDF exploit in iOS

by Megan Lavey-Heaton Aug 3rd 2010 at 1:45PM

We reported on the return of browser-based jailbreakme.com yesterday. Today IT security guru F-Secure revealed just how the site is able to work.

The jailbreak method utilizes a PDF exploit found in the iOS software. Charlie Miller with Independent Security Evaluators, tweeted, " Starting to get a handle on jailbreakme.com exploit. Very beautiful work. Scary how it totally defeats Apple's security architecture."

What the exploit does is take a PDF sitting in a subdirectory of jailbreakme.com, shown on the right, and brings it into your device. PDF browsing is done through Safari, and the jailbreak exploits that weakness by using a corrupted font placed inside the PDF file to crash the Compact Font Format handler and allows access to the iOS.

iPhone devteam member chpwn told us today, "There are other (public) exploits in Safari, including some on Apple's website that are fixed in desktop Safari but not iOS. Therefore, the JailbreakMe exploit isn't really a big deal for security."

And even if it is, apparently there are other ways into the system. Comex, author of the exploit, sent a tweet yesterday saying, "M aybe I'll rely on USB based stuff for the next jailbreak so that Apple won't patch it so fast."


View Tags

Related Stories

Categories

iPhone iOS

We reported on the return of browser-based jailbreakme.com yesterday. Today IT security guru F-Secure revealed just how the site is able to...
 

Add a Comment

Sign in »
*0 / 3000 Character Maximum

14 Comments

Filter by:
Pat

Why in the world would anyone publish this?! Might as well tell Apple how to fix it, because you know it's gonna happen anyway in 2 weeks. Idiots

August 03 2010 at 5:50 PM Report abuse rate up rate down Reply
2 replies to Pat's comment
Justin

Apple probably figured this out on their own shortly after the jailbreak was released (they do have some very smart people working there). I knew it was pdf based (as I took a quick peek into that directory before I was doing the jailbreak), but I didn't quite get what pdf issue they were exploiting. We knew that there would be a fix to this in 4.1, or even in a 4.0.2, but those who want the jailbreak know to simply avoid Apple updates and save their SHSH blobs on Saurik's servers.

August 03 2010 at 7:32 PM Report abuse rate up rate down Reply
DA360

Apple already has fixed it, the fix just hasn't come to the iOS version of Safari, but its coming. It was implemented in the newest Safari for Mac OS and Windows before this jailbreak happend, and has been implemented in the iOS 4.1 betas (thus why Jailbreakme.com recommends NOT going beyond 4.0.1).

August 03 2010 at 7:52 PM Report abuse rate up rate down Reply
JDavila

Why these 'security firms' and 'gurus' don't shut up? If they are not helping the majority, then they should refrain themselves from making statements about how they 'brilliantly found' the exploit?

If they are so good at it, why don't they prove the other way, detect and show an exploit before the real thinkers like @Comex and the rest of the Dev Team?

Isn't that their work? TO PREVENT THINGS FROM HAPPENNING instead of piggy-backing???

August 03 2010 at 2:50 PM Report abuse rate up rate down Reply
1 reply to JDavila's comment
Fabio P

its apple's job to "stop the dev team" not that of a security firm.
after all, apple doesn't pay them. most of the time not even the credits to the security hole.
beside, the dev team is smarter than many of the other security firms as they've shown previously.

when they say its "Very beautiful work." it is just a tweet, and nothing more than a tweet.
he is expressing his respect to comex. When other people and blogs pick his tweet up and write an article, it's not his fault.

"If they are not helping the majority, then they should refrain themselves" Tell that to the people who fight the HI Virus. It's not helping the majority, since HI Positive people are a minority. should the researched refrain themselves too?

August 03 2010 at 2:56 PM Report abuse rate up rate down Reply
edd payton

Does this mean that Comexs and The Dev Teams work is going to go to waste? Apple isnt going to allow an vulnerability like this be unpatched very long - and they will patch the jailbreak in the process!!

August 03 2010 at 2:21 PM Report abuse rate up rate down Reply
2 replies to edd payton's comment
Javier Quintana

I'll let @musclenerd answer that ;)

"Apple will fix this bug very quickly. Run FW Umbrella http://is.gd/dYkKl now so you can use jailbreakme.com forever."

and

"Even those who don't want to JB right now, run FW Umbrella now for when you later realize you do :) There is a "too late""

August 03 2010 at 2:35 PM Report abuse rate up rate down Reply
mark

Yes but if you have your shsh on file via cydia/tinyumbrella, you can always restore to the firmware you are on and then you can always go to the website to jailbreak it.

Apple's fix will only affect people on whatever the next firmware version is 4.1, etc.

August 03 2010 at 2:38 PM Report abuse rate up rate down Reply
urth

"Anyone want to bet about how long until a fix is released?"

August 03 2010 at 2:06 PM Report abuse rate up rate down Reply
Buy an ad here

Hot Apps on TUAW

Tweets

© 2012 AOL Inc. All Rights Reserved.