2

I'm just wondering. How does iOS prevent someone from executing code on their device that isn't from Apple or downloaded from the App Store?

Also what exactly, does a Jailbreak do to allow unauthorised code to be run on an iOS device?

Also are the steps to Jailbreak a device repeatable when a new version of iOS is released? I was wondering because when a new version of iOS is released there is usually a Jailbreak within a few hours.

I heard it was something to do with the security certificate that Apple gives to each of its developers, but I don't know anything more than that.

7

Once a computer boots, the operating system is given near exclusive control over the system resources (kernel access). After this occurs, if a program wants to run, it must ask the OS to let it run. Before iOS allows an application to run, it examines the code that is going to be loaded in to memory from the binary and checks it against a signed value that proves to the OS that Apple has reviewed the contents of the binary and given it the green light. Only after this check succeeds is the code allowed to run.

Jailbreaking removes this check by altering the OS such that it sees all applications as valid and allows them to run. Since Apple won't sign an application that makes these changes, exploits have to be used in high privilege signed code (normally the OS itself) to allow the needed changes to be injected in to the system.

The same exact kind of security could be implemented on other devices as well (in fact, it is optionally able to be turned on in Android) however, not having the option to turn it off is highly contentious as at that point you don't really own your own hardware anymore since someone else is telling you what you can and can't do with it. It is good for preventing people from accidentally installing bad things, but bad from a user freedom perspective (which is the main reason we haven't seen this technology expand in to desktops despite the fact it is completely technically possible to do so.)

  • Do jailbreaks really exploit signed applications? I thought they exploited iOS itself? – RoraΖ Aug 15 '14 at 14:03
  • @raz - sorry, I'm thinking as a developer where the OS itself is also an application of types. Beyond the kernel, most of the functionality is provided by applications that run as part of the OS, but any high privileged application could be used in theory. I switched it to use the term "high privileged code" to be more clear. – AJ Henderson Aug 15 '14 at 14:06
  • Gotcha, I see where you're coming from. Nice answer by the way. – RoraΖ Aug 15 '14 at 14:21
5

An app must be code signed with a certificate issued by Apple. Whenever an app is run this signature is checked using its public key. As long as the certificate chain is traced back to Apple as the Certificate Authority, then the app is authenticated. More info on Code Signing. This is a bit of a generalization. Detailed guide from Mac Developer Library

Jailbreaking provides privilege escalation, which can enable the installation of unauthorized third party applications. It's basically hacking iOS. Generally the process is done via some type of vulnerability in iOS which is exploited to give you these higher privileges. The process remains the same unless Apple patches the vulnerability in an update.

When a new version of iOS comes out, sometimes the vulnerability still exists. Sometimes the process only changes slightly, and code can be re-used from a previous jailbreaking technique. It just all depends on the vulnerability that's being exploited.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.