2

Generally speaking, when an iOS device is purchased, it will be a couple of security updates behind the latest version of iOS. This means that in many cases, out of the box an iOS device will be vulnerable to a jailbreak and installation of malware.

What is to prevent the following technique to install persistent malware on an iOS device (assuming physical access and posession of the passcode):

  1. Jailbreak the device using an untethered jailbreak

  2. Install software that replaces or modifies Springboard and Settings, as well as the actual malware

  3. Replace or change the behaviour of the iOS update and factory reset features to either prevent those actions entirely, or reinstall the malware after they take place

I understand that iOS requires applications to be signed before they run, but presumably jailbreaking removes this restriction or adds new key pairs where the private key is known. So to my naive eye it might be practical to, for example, modify a couple of instructions in the Settings app, re-sign it using the new key added by the jailbreak, install this new version on the device, and replace Springboard with a version that links to it.

This all sounds too simple to be possible, and assuming that's the case I am interested in explanations of technical measures taken to prevent it.

1
  • 1
    I discussed points of this in a post earlier which outlines the need for a custom kernel for the modified file system (privilege elevation) to be persistent without the user's knowledge. This will assume the malware has root level (or above) access. As to circumvent the need for signed code. Making the malware resilient to an on-device factory reset, as our patched kernel could produced or remove the checksum validation on boot. security.stackexchange.com/questions/190995/…
    – safesploit
    Aug 5, 2018 at 14:22

1 Answer 1

-1

Have you looked at iphonehacks.com and posted on their site? Once the device is jailbroken it is pretty much open season on the device. If you are thinking you can get malware on the device that persists past re-installing the genuine OS good luck. That would be a firmware hack and that is part of the reason that government agencies won't allow employees or contractors to use any phone manufactured in China.

1
  • 1
    I... what? Modifying firmware is really not that hard...
    – forest
    Sep 4, 2018 at 19:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .