The days of the “hack-proof” iPhone may be over.
A pseudonymous Twitter user called axi0mX posted a thread today (Sept. 27) introducing checkm8, a “permanent unpatchable bootrom exploit for hundreds of millions of iOS devices.”
“Most generations of iPhones and iPads are vulnerable,” axi0mX continued, “from iPhone 4S (A5 chip) to iPhone 8 and iPhone X (A11 chip). … This is possibly the biggest news in [the] iOS jailbreak community in years.”
But before you get excited, and before we get into the technical details, this is a deep-level software/hardware issue and requires special hardware and special software to exploit. There is no quick-and-easy hack or jailbreak related to this — yet.
The bootrom is equivalent to the BIOS or UEFI firmware that starts up a PC, except that on a PC, that firmware can be updated. On an iPhone, it can’t be, which does make this exploit a big deal.
Another iOS jailbreaker on Twitter, Morpheus______, responded to axi0mX’s Twitter thread by saying that this is “not ‘possibly the biggest’ [news]. THE Biggest.”
Morpheus______ followed up by explaining that “any iPhone 8/X or earlier can now be:
— booted to any iOS version, past/present/future, with no SHSH/APTickets
— booted to any OS (e.g. Android)
— compromised by attacker w/physical access, but still requires password (or brute force)for private data.”
Is my iPhone about to be hacked?
So do you need to worry that someone’s going to hack your two-year-old iPhone? Not really. First of all, checkm8 requires physical access to an iOS device. The whole thing can be downloaded from GitHub, although axi0mX warns that it could brick your phone.
It also doesn’t work on Apple’s most recent systems-on-a-chip. Those would be the A12 Bionic, which powers the iPhone XS, XS Max and XR and the most recent iPad Mini and iPad Air, and the A13 Bionic, which is in the iPhone 11, 11 Pro and 11 Pro Max.
“What I am releasing today is not a full jailbreak with Cydia, just an exploit,” said axi0mX. “Researchers and developers can use it to dump SecureROM, decrypt keybags with AES engine, and demote the device to enable JTAG. You still need additional hardware and software to use JTAG.”
In other words, you can use the checkm8 software to extract the bootrom code from an iPhone, if the phone is connected to a Mac or Linux machine via USB. The software will decrypt the secure data and unlock the device to provide JTAG access.
JTAG is a computer-industry standard for testing circuit boards, but some circuit boards require special connectors for physical JTAG access. It appears the various iPhone circuit boards may be among them.
“Maybe someone can figure out a nice way to use JTAG on iPhone without proprietary hardware and software,” axi0mX wrote. “I and many others would be forever grateful if someone makes that possible.”