Feasibility of persistent iOS malware which survives factory reset

Question

Generally speaking, when an iOS device is purchased, it will be a couple of security updates behind the latest version of iOS. This means that in many cases, out of the box an iOS device will be vulnerable to a jailbreak and installation of malware.

What is to prevent the following technique to install persistent malware on an iOS device (assuming physical access and posession of the passcode):

1. Jailbreak the device using an untethered jailbreak

2. Install software that replaces or modifies Springboard and Settings, as well as the actual malware

3. Replace or change the behaviour of the iOS update and factory reset features to either prevent those actions entirely, or reinstall the malware after they take place

I understand that iOS requires applications to be signed before they run, but presumably jailbreaking removes this restriction or adds new key pairs where the private key is known. So to my naive eye it might be practical to, for example, modify a couple of instructions in the Settings app, re-sign it using the new key added by the jailbreak, install this new version on the device, and replace Springboard with a version that links to it.

This all sounds too simple to be possible, and assuming that's the case I am interested in explanations of technical measures taken to prevent it.

Answer 1

Have you looked at iphonehacks.com and posted on their site? Once the device is jailbroken it is pretty much open season on the device. If you are thinking you can get malware on the device that persists past re-installing the genuine OS good luck. That would be a firmware hack and that is part of the reason that government agencies won't allow employees or contractors to use any phone manufactured in China.