John Cox, Network World, 12/10/2010

Version 4.2 disables a query to discover compromised OS

Apple has disabled, without explanation, a jailbreak detection API in iOS less than six months after introducing it. Device management vendors say the reasons for the decision are a mystery, but insist they can use alternatives to discover if an iPhone, iPod touch or iPad has been modified so they can load and modify applications outside of Apple’s iTunes-based App Store.

Jailbroken devices pose a serious security threat to the enterprise. Even if the end user doesn’t intend to load malware, he will be completely unaware of malware present in unauthorized apps.

The new API was part of a bundle of mobile device management (MDM) APIs released in June with iOS 4.0. These APIs were available to third-party MDM applications, such as AirWatch or Sybase’s Afaria. With the new APIs, these servers could access directly a range of features and information in iOS or on the device. But in the recently-released 4.2 version, the API intended for detecting jailbreaks has been either removed or disabled.

This detection API let the MDM applications in effect ask the operating system if it had been compromised. Jailbreak exploits typically change a number of operating system files, and exploit one or another low-level OS features to let users directly load their own or third-party applications. In October 2010, two separate jailbreaks made use of different vulnerabilities uncovered in the iOS boot ROM, for example. Apple warns that jailbreaking voids the device’s warranty and could damage the phone.

Previously, some MDM vendors had created their own series of OS checks to detect jailbreaks, analogous to those performed by an anti-virus application on a PC, to discover if a jailbreak had occurred.

But the new detection API gave these applications direct access to information in the OS. In theory, the iOS device then “confesses” that it has been jailbroken, thereby triggering automatic responses such as alerting the helpdesk or shutting down access to corporate Exchange Server e-mail.

“We used it when it was available, but as an adjunct,” says Joe Owen, vice president of engineering at Sybase, which offers the Afaria device management software. “I’m not sure what motivated their removing that….I’ve not had anyone [at enterprise customer sites] talk to me about this API being present or being removed.”

In practice, Apple’s idea of using an API-based query turned out to be much more complicated than it sounds. “It’s an interesting concept – asking the OS to tell you if it has been compromised,” Owen says. “Because a smart attacker might first change that very part of the OS.  Jailbreaks often get better and better at disguising the fact that anything has been compromised.”

When that happens, the API in effect either lies about or is simply unaware of the jailbreak.

“[I]t may be feasible to detect jailbreaks of a specific version or type, but they will still be trapped in the cat and mouse game they play with jailbreakers,” says Jeremy Allen, principal consultant with Intrepidus Group, a security consulting firm. “Whatever they add [in the OS] to detect the jailbreak, if it is to be queried from the iOS kernel, it must be accessible and have the ability to be changed. Meaning, if it is going to be a useful detection method it can also be circumvented. It is a fairly intractable problem to solve 100%.”

For a group of computer-savvy end users, jailbreaking is an unalloyed benefit, not to mention a civil right, letting them load any applications they wish. But for enterprise IT, jailbroken iOS devices create a serious security threat.

“When jailbreaking and or rooting a [mobile] device, the goal is to circumvent or disable the pieces of the OS and platform that keep applications in a sandbox and running with limited privileges,” Allen wrote in a recent blogpost on trusting mobile platforms. “These devices could be difficult, or even impossible, to enforce security policy on as the user can trivially circumvent the policy enforcement without the management servers being aware of it.”

MDM vendors such as Good Technology, MobileIron and Sybase all claim to be able to detect jailbroken iOS devices without the disabled Apple API. Typically, their on-device apps, in conjunction with the server, run a series of checks or try to do things that are forbidden by Apple, such as accessing certain underlying OS primitives. If the app can take these actions, it reports back that the device is jailbroken, and then can block or restrict access to the corporate network.

These techniques are not foolproof, cautions Intrepidus’ Jeremy Allen.

“These methods cannot be relied upon with a high degree of confidence, but they would certainly catch many who jailbreak, just not all of them,” he says. “I see it as a useful tool, but not an all-encompassing solution.”

Allen strongly encourages enterprises to take a multi-layered approach and be realistic about the risks. “I always stress, heavily, [the importance of] educating users about the risks of jailbreaking,” he says. “I feel that organizations must outline, in formal policy, that jailbreaking is not permitted. Many users are simply unaware of the risks associated with operating a jailbroken device.”

Given the ongoing ingenuity of hackers, enterprises have to be plan accordingly, Allen warns. “For the users that still engage in jailbreaking, with full knowledge of the risks and detection mechanisms, there is little recourse to finding them,” he says.

Related posts:

1. Mobile group drops Java price against Apple and Android Gavin Clarke, The Register, 6/22/2010 Mobile phone providers are fighting...
2. iPhone OS 4 jailbreak available, enables multitasking on 3G Chris Foresman, Ars Technica, 4/16//2010 iPhone OS 4, set to...
3. Jailbreak for iPad and newer iPhone released Adrian Kingsley-Hughes, ZDNet, 5/3/2010 Hackers have released a package that...

Steven Musi, CNET News, 8/22/2010

Apple is apparently ramping up its battle to prevent iPhone and iPod owners from jailbreaking their devices.

The company has applied for a patent, titled “Systems and Methods for Identifying Unauthorized Users of an Electronic Device,” that covers a series of security measures to automatically protect devices from thieves and other “unauthorized users.” Unauthorized users apparently applies to those who engage in jailbreaking, which allows devices to run apps not approved by the company producing the operating system–such as Apple, the main target of such bypasses.

The application, which was filed in February 2009 and published Thursday, describes measures to identify “particular activities that may indicate suspicious behavior,” so that “safety measures” can be taken to restrict the device’s functions. Those activities include the “hacking, jailbreaking, unlocking, or removal of a SIM card,” according to the application. Apple also intends to send warnings to owners via e-mail or text message when such activity is detected.

The application also describes a variety of measures that could be used to help identify the unauthorized user, including the activation of a camera that could capture and geotag the device’s surroundings, and perhaps current user, and transmit that information to a remote device:

In some embodiments, an unauthorized user can be detected by comparing the identity of the current user to the identities of authorized users of the electronic device. For example, a photograph of the current user can be taken, a recording of the current user’s voice can be recorded, the heartbeat of the current user can be recorded, or any combination of the above. The photograph, recording, or heartbeat can be compared, respectively, to a photograph, recording, or heartbeat of authorized users of the electronic device to determine whether they match. If they do not match, the current user can be detected as an unauthorized user.

When unauthorized use has been detected, “access to particular applications can be restricted, access to sensitive information can be restricted, sensitive information can be erased from the electronic device…,” the application states, effectively wiping and bricking the device.

Apple representatives did not immediately respond to a request for comment.

In July, U.S. Copyright Office ruled that bypassing a manufacturer’s protection mechanisms to allow “handsets to execute software applications” no longer violates federal copyright law. However, while the U.S. Copyright Office has declared the software legal, Apple has repeatedly discouraged users from loading such a bypass, reminding them that doing so will void their device’s warranty.

“As we’ve said before, the vast majority of customers do not jailbreak their iPhones as this can violate the warranty and can cause the iPhone to become unstable and not work reliably,” Apple had said in a statement in response to the ruling.

Related posts:

1. Apple placing ban on jailbroken devices? iPodNN, 12/15/2010 According to a report, Apple has begun banning...
2. Apple tries to patent method to lock down your mobile device Chris Foresman, Ars technica, 10/2/2009 Hate that carriers often cripple...
3. Apple Patent Application Details iPhone Control Via Finger Swipes Over Camera MacRumors, 2/25/2010 Patently Apple points to another interesting patent application...

Dan Goodin, The Register, 8/5/2010

Related posts:

1. Encrypting your iPhone backups? Time to choose a better password Greg Kumparak, Mobile Crunch, 2/8/2010 If you’re using the backup...
2. Jailbreaking your iPhone: The pros and cons Mike Keller, PC World, 11/13/2009 iPhone “jailbreaking” has been a...
3. Web service automates WordPress password cracking John Leyden, The Register, 11/30/2009 Malefactors debut Hacking as a...

Andy Patrizio, InternetNews.com, 7/29/2010

The Library of Congress has ruled that modifying smartphones without the device maker’s permission, legitimizing the activities of one segment of the digital underground.

Apple has kept a tight grip on the iPhone since its release, repeatedly defending its rules regarding the apps users can run and the ban on modifications as necessary controls to preserve the user experience. But, it now seems, users who wish to skirt Apple’s rules are welcome to do so under the law.

That’s because the Library of Congress, which oversees the Copyright Office and periodically reviews issues under the Digital Millennium Copyright Act, has determined that users can modify, or jailbreak, their iPhones and other devices under the fair use protections of that statute. DevX takes a look.

The federal government today announced new exemptions under the Digital Millennium Copyright Act (DMCA) that will allow for the modification of smartphones, most notably Apple’s iPhone, without the handset maker’s or carrier’s approval.

The ruling, issued by the Library of Congress, means that it’s now legal to “jailbreak” an iPhone and put apps on it that Apple has not approved and does not endorse. The ruling came from the Library of Congress because it oversees the Copyright Office, which reviews and authorizes exemptions to the DMCA every three years to find fair use exemptions.

Related posts:

1. redsn0w 0.9.2 unlocks/jailbreaks all iPhone & iPod touch models Chris Davies, Slash Gear, 2/2/2010 The iPhone Dev Team have...
2. Drag Drop JavaScript Library for iPad & iPhone Hatem, AJAX Magazine, 5/20/2010 Tommaso Buvoli has written a JavaScript...
3. Want to connect your iPhone and Bluetooth keyboard? There’s a (jailbroken) app for that Vladislav Savov, Engadget, 12/24/2009 The wait has been long, but...

Chris Foresman, ArsTechnica, 5/28/2010

Though Apple has added additional data security features to the iPhone with every iteration of the OS—including encrypting files on-device for the iPhone 3GS—vulnerabilities still exist. These issues are of particular concern to enterprise users, since sensitive corporate data may exist on any given employee’s mobile device. A new vulnerability revealed by security researcher Bernd Marienfeldt, however, shows that all someone needs to get at that data is the latest version of Ubuntu.

Noted iPhone data forensics expert Jonathan Zdziarski demonstrated last year that common hacking tools could remove the data protection features that Apple added with iPhone OS 3.x and the iPhone 3GS. He told Ars that there are ways to get around both the on-device encryption as well as the encrypted backups that can be saved via iTunes. “The only benefit hardware encryption [as implemented] is that it makes wipes faster, by just dropping the [encryption] key,” he said. But even the remote wipe feature can be thwarted by removing a device’s SIM card.

Marienfeldt’s research revealed that standard hacking or jailbreaking tools aren’t even needed to get at the data. The latest version of Ubuntu (10.04) will auto mount the flash storage in an iPhone, allowing access to all of the information contained within. Files can be accessed even if a pin code is set.

Zdziarski warned that the way encryption worked on the iPhone could be exploited in this way if a tool allowed the iPhone’s file system to be mounted. “The [iPhone OS] kernel decrypts it for you when you ask for files, so you get the decrypted copy,” he told Ars last summer.

Here you can see the entire filesystem of an iPhone 3GS with PIN code lock displayed under Ubuntu 10.04.

Image credit: Bernd Marienfeldt

Marienfeldt verified that only the DCIM folder, where images and videos are stored, is accessible on Mac OS X, Windows, and Linux—even older versions of Ubuntu. However, Lucid Lynx will, when set to auto mount USB-based devices, expose the entire filesystem of any iPhone. “This data protection flaw exposes music, photos, videos, podcasts, voice recordings, Google safe browsing database, game contents,” Marienfeldt wrote on his blog.

He has shared his findings with Apple, and engineers were able to verify the problem. “Apple could reproduce the described serious issue and believes [it understands] why this can happen but cannot provide timing or further details on the release of a fix,” Marienfeldt said.

Of course, knowing that pretty much anyone with Ubuntu installed can get at all of your data is troubling. Marienfeldt noted that this problem is quite serious for enterprise users, especially since companies “rely on the expectation that their iPhone 3GS’s whole content is protected by encryption with a PIN code based authentication in place to unlock it.” This is probably true; Steve Jobs recently noted during the iPhone OS 4.0 preview that 80 percent of Fortune 100 companies have employees using iPhones as a work-related mobile device.

AT&T also said that 40 percent of iPhones are now sold to enterprise users. “When the iPhone came out, what most people heard in the first year from ’07 to ’08 was oh my God, it’s not BlackBerry secure; this is not going to work on the enterprise space,” AT&T Business Solutions CEO Ron Spears said recently during the Barclays Capital Communications, Media and Technology Conference. “And by the time the 3G came out in ‘08 they had solved about 80 percent of the security issues. By the time the 3GS came out last summer, most CIOs will tell you today they have very few issues around the security that they need provided.”

However, this latest example shows that Apple has some work ahead of it to beef up security for its mobile platform. Apple has promised more robust encryption options for iPhone OS 4.0, including giving developers an API to encrypt their applications’ data separately. If these new options rely on the same encryption system as current iPhones, though, that won’t be enough. Marienfeldt recommends that Apple employ a more robust full disk encryption method, one that requires the PIN code to be entered before the filesystem will mount on any OS.

Related posts:

1. Spyware threat haunts squeaky-clean iPhones John Leyden, The Register, 12/4/2009 Research finds rogue app privacy...
2. HTML5 raises new security issues Joab Jackson, IDG News Service, 8/20/2010 As HTML5 enhances the...
3. Ubuntu One to Offer Music Streaming to iPhone and Android, Windows Client Kevin Purdy, LifeHacker, 10/7/2010 We mentioned the rather nifty cloud-syncing/mobile-streaming...

Brandon Hill, DailyTech, 5/19/2010

“Official” tethering comes at last for iPhone users

Well, it only took a year. A little over a year ago, Apple announced iPhone OS 3.0 and along with it came support for 3G internet tethering. The only problem was that while many wireless carriers around the world offered the tethering option to iPhone users, AT&T bowed out due to the strain that the popular smartphone was putting on its 3G network.

Well if the latest beta release of iPhone OS 4.0 is any indication, it looks as though the long wait is now over. Apple this evening seeded iPhone OS 4.0 Beta 4 to developers according to Mac Rumors and it includes an option to enable internet tethering.

The new option, which appears in the Network tab under Settings, gives users the ability to enable tethering by dialing 611 or visiting http://www.att.com/mywireless” rel=”nofollow. We don’t currently have any official word on pricing for the tethering option, but there’s a close to 100 percent guarantee that the word “free” won’t be anywhere in the fine print.

IPhone users who jailbreak can currently get free, quick, and easy tethering on AT&T’s network using a program like MyWi, but it’s not officially sanctioned by Apple or AT&T.

In other tethering news, it was recently revealed that Google has enabled native tethering and Wi-Fi hotspot capabilities in its updated Android 2.2 operating system. It remains to be seen, however, it carriers will play nice and provide the features for free.

Related posts:

1. AT&T says network needs more work to support iPhone tethering Sam Oliver, Apple Insider, 10/8/2009 AT&T made a surprising announcement...
2. Tethering: Droid Gets A Date, iPhone Still MIA David Coursey, TechInsiter, 11/4/2009 Good news for Droid customers: Verizon...
3. AT&T remains elusive on official date for iPhone tethering TJ Luoma, TUAW, 10/14/2009 iPhone users have been waiting for...

Adrian Kingsley-Hughes, ZDNet, 5/3/2010

Hackers have released a package that jailbreaks the iPad and newer iPhone OS, allowing users to install hundreds to unapproved apps on their Apple-branded device.

The package, called Spirit, jailbreaks all iPad, iPod touch or iPhone devices running OS 3.1.2, 3.1.3 and 3.2.

Here’s the details:

• Spirit is an untethered jailbreak for iPad, iPhone, and iPod touch on the latest firmwares.
• Spirit is not a carrier unlock.
• If you currently are using a tethered jailbreak, you have to restore to use Spirit. Do not upgrade if you use an unlock on an iPhone 3G or 3GS. (You can, however, restore to 3.1.2 if you have SHSH blobs for that version.)

Spirit will work only on iPhone handsets that have been activated and they need to be running an unmodified version of recent firmware. Devices that have been previously jailbroken need to be restored to 3.1.2 before applying the Spirit patch.

Related posts:

1. iPad jailbreak released, works on iPhone and iPod touch Aron Trimble, TUAW, 5/3/2010 Within a few hours of its...
2. Sn0wbreeze 1.4 Released to Jailbreak and Unlock iPhone OS 3.1.3 iPhone Hacks, 2/8/2010 iH8sn0w dev team have released Sn0wbreeze 1.4...
3. iPad jailbroken already, using leftover security flaw Casey Johnston, Ars Technica, 4/5/2010 The iPad, scarcely two days...

Aron Trimble, TUAW, 5/3/2010

The current jailbreak, dubbed “Spirit,” allows you to jailbreak all models of iPad, iPhone, and iPod touch running the latest firmwares available (3.2 and 3.1.3, respectively, as of this writing).

Also, the authors note that “On iPad, all this is still sort of beta,” and as such if anything goes wrong you might need to restore.

Related posts:

1. Jailbreak for iPad and newer iPhone released Adrian Kingsley-Hughes, ZDNet, 5/3/2010 Hackers have released a package that...
2. Sn0wbreeze 1.4 Released to Jailbreak and Unlock iPhone OS 3.1.3 iPhone Hacks, 2/8/2010 iH8sn0w dev team have released Sn0wbreeze 1.4...
3. iPhone OS 3.2 references new iPhone, iPod touch, iPad models Chris Foresman, ArsTechnica, 4/5/2010 The iPad is out, and the...

Prince McLean, AppleInsider, 4/21/2010

Apple has posted a support document targeting iPhone jailbreaking, noting that “unauthorized modification of iPhone OS has been a major source of instability, disruption of services, and other issues,” including compromised security.

The article addresses “adverse issues experienced by customers who have made unauthorized modifications to the iPhone OS (this hacking process is often called ‘jailbreaking’).”

The support note says, “as designed by Apple, the iPhone OS ensures that the iPhone, iPad, and iPod touch operate reliably. Some customers have not understood the risks of installing software that makes unauthorized modifications to the iPhone OS (“jailbreaking”) on their iPhone, iPad, or iPod touch. Customers who have installed software that makes these modifications have encountered numerous problems in the operation of their hacked iPhone, iPad, or iPod touch. Examples of issues caused by these unauthorized modifications to the iPhone OS have included the following:

Device and application instability: Frequent and unexpected crashes of the device, crashes and freezes of built-in apps and third-party apps, and loss of data.

Unreliable voice and data: Dropped calls, slow or unreliable data connections, and delayed or inaccurate location data.

Disruption of services: Services such as Visual Voicemail, YouTube, Weather, and Stocks have been disrupted or no longer work on the device. Additionally, third-party apps that use the Apple Push Notification Service have had difficulty receiving notifications or received notifications that were intended for a different hacked device. Other push-based services such as MobileMe and Exchange have experienced problems synchronizing data with their respective servers.

Compromised security: Security compromises have been introduced by these modifications that could allow hackers to steal personal information, damage the device, attack the wireless network, or introduce malware or viruses.

Shortened battery life: The hacked software has caused an accelerated battery drain that shortens the operation of an iPhone, iPad, or iPod touch on a single battery charge.

Inability to apply future software updates: Some unauthorized modifications have caused damage to the iPhone OS that is not repairable. This can result in the hacked iPhone, iPad, or iPod touch becoming permanently inoperable when a future Apple-supplied iPhone OS update is installed.

“Apple strongly cautions against installing any software that hacks the iPhone OS. It is also important to note that unauthorized modification of the iPhone OS is a violation of the iPhone end-user license agreement and because of this, Apple may deny service for an iPhone, iPad, or iPod touch that has installed any unauthorized software.”

Apple fights for control of its App Store

Last year, Apple argued against claims filed by the Electronic Frontier Foundation which proposed a legal exemption to the DMCA that could enable large scale commercial jailbreaking that could no longer be challenged under existing laws. The EFF argued such an exemption would allow more innovation and investment in creative works.

Apple argued that the “EFF apparently desires to use the rulemaking process to alter Apple’s business practices by negating DMCA protection for technologies that interfere with what EFF seems to assume would be a more socially desirable business model that is more ‘open.’ Specifically, it seeks through the proposed exemption to clear the path for those who would hack the iPhone’s operating system so that a proprietary mobile computing platform protected by copyright can be transformed into one on which any third party application can be run, without taking account of the undesirable consequences that would ensue from the transformation.”

The company stated that its App Store market is a critical part of what has made the iPhone successful. “The platform provided by the OS has created positive feedback loops so that a large community of developers has been willing to invest in iPhone technologies, elevate the platform and the iPhone user experience, and benefit themselves, Apple and consumers alike.” Apple also outlined the iPhone OS’ security model as a potential casualty of any exemption.

It also cited the company’s existing problems in dealing with millions of error reports from jailbroken phones, and cited the a variety of new issues it would have to deal with if the DMCA was relaxed to protect widespread commercial jailbreaking. Those factors included the unrestricted distribution of potentially harmful apps that could flood mobile networks, perform malicious actions, enable widespread piracy, and cause crashes or service degradation and stability problems.

The ruling on the DMCA exemption is still pending (and has been since late 2008). A ruling could be handed down at any time. However, any exemption granted would would only apply to the iPhone and not to the new iPad, since the EFF’s original complaint did not anticipate its delivery when filing for an exemption to legally protect jailbreaking.

Apple has taken no legal action against individuals who jailbreak their iPhone OS devices, other than to issue warnings about potential problems this may cause and the possibility of a loss in warranty coverage that might result from software tampering.

The company’s position against the EFF-proposed exemption appears to be targeted at preventing large scale commercial efforts to dismantle Apple’s control over its own platform and replace it with a model more like Android Market, where there is less development, less commercial motivation to create apps, large security holes in how apps are installed, and no coherent strategy for progressively moving the platform ahead. The Android platform is in many respects similar to a jailbroken iPhone.

Related posts:

1. Jailbreaking in the iPhone 3.0 era Mel Beckman, ComputerWorld, 3/1/2010 In a few short years, Apple...
2. blacksn0w unlocks 3.1.2; Apple looks to curtail jailbreaking Chris Foresman, Ars Technica, 11/4/2009 You can now jailbreak and...
3. Cracking software retrieves iPhone 4 passwords: No jailbreaking necessary Dan Goodin, The Register, 8/5/2010 A Russian password-cracking company has...

Chris Foresman, Ars Technica, 4/16//2010

iPhone OS 4, set to ship later this summer, has already been jailbroken. The iPhoneDevTeam has released a preliminary beta of the redsn0w jailbreaking tool, but be warned: it’s definitely not for the casual jailbreaker.

redsn0w 0.9.5 is a beta release with limited functionality. Right now, it only supports jailbreaking iPhone OS 4.0 beta 1 on iPhone 3G hardware and the tool only runs on Mac OS X. The iPhoneDevTeam also notes that the beta firmware overwrites the baseband firmware, so it’s not compatible with carrier unlocks at this time.

This beta is designed to give jailbreak app developers an opportunity to update their apps to work with the latest APIs, as many private APIs and other functions used by jailbreak apps no longer work properly on 4.0. Another sign that this release is geared towards developers is the lack of automatic “hacktivation”; only developers with a registered UDID can get past the activation screen after the jailbroken firmware is loaded.

One thing to note is that the jailbreak makes it possible to enable Apple’s iPhone OS 4.0 multitasking system on the iPhone 3G, despite the fact that Apple has said that the hardware can’t support it.

Related posts:

1. Jailbreak for iPad and newer iPhone released Adrian Kingsley-Hughes, ZDNet, 5/3/2010 Hackers have released a package that...
2. iPad jailbreak released, works on iPhone and iPod touch Aron Trimble, TUAW, 5/3/2010 Within a few hours of its...
3. Sn0wbreeze 1.4 Released to Jailbreak and Unlock iPhone OS 3.1.3 iPhone Hacks, 2/8/2010 iH8sn0w dev team have released Sn0wbreeze 1.4...