Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Apple's new iPhone moves impact more than just consumer tech

Steve Ragan | Sept. 11, 2013
Apple unveils its latest iPhone and new enhancements, including a new biometric security offering called Touch ID. But will these features have any impact to corporate security?

"The concern is that the device is jailbreakable. It not being jailbroken yet doesn't help [emphasis his]. In fact, if you jailbreak it, you might be able to install security patches, or other hardening features, on the device that will keep it from being attacked later."

Existing mobile device management solutions will do little to stop jailbreaking, if they can stop it at all, Freeman explained when asked about such a protection.

"I have never heard of an MDM solution that could somehow prevent a jailbreak. And the concept of detecting a jailbreak from an app is fundamentally flawed as you are at the same privilege layer as the attacker (but play your hand later), so you will lose."

When asked about the timing of jailbreaks in relation to iOS releases, Freeman pointed CSO to a post of his on Reddit, where he commented on how complicated the process can be. While many believe that jailbreaking a device is as simple as exploit-and-go, the reality is completely different.

Previous widely publicized jailbreaks relied on "userland" exploits — or bugs that exist in software (such as a browser). The problem is that this created a cat-and-mouse game with Apple and the jailbreaking community. They'd discover weakness and jailbreak devices with it; Apple would patch that flaw and prevent the same trick from working again.

The iPhone4 was the last Apple device to be permanently jailbroken. But the existence of userland bugs created a misunderstanding when it came to the difficulty of jailbreaks and how they related to firmware updates.

"These userland jailbreaks require multiple bugs, and one of the bugs has to be in the kernel (in order to deactivate the codesign protection). Meanwhile, Apple has stepped up their game, adding stronger protections like kernel ASLR. This means that the jailbreak community is working with a dwindling supply of "known bugs," has more complex challenges being faced to exploit these bugs, and operates under the knowledge that any new OS update fixes everything," Freeman wrote.

So with the pending release of iOS 7, following a beta where developers had access to the code for a short time, the notion of a jailbreak for it is still in the air. It will take some time however, as Freeman said that in general the jailbreak community doesn't work with beta software for either development work or exploit finding.

"Apple betas tend to be a seriously moving target. Things that don't affect developers or that aren't 'risky' thereby tend to end up in later betas, and bugs that are present early are often just temporary as Apple is 'still working on it'," he said.

 

Previous Page  1  2  3  4  Next Page 

Sign up for CIO Asia eNewsletters.