You used to be able to jailbreak one of the first iPhones and install Cydia just by visiting some page in Safari and clicking on a button, IIRC. I never did this myself, so my memories might be inaccurate though.

Right! One of the famous initial iPhone OS exploits involved a vulnerability in LibTiff. Decoding a crafted .tiff in Safari would grant the site's javascript root access.

Read more: https://books.google.com/books?id=1kDcjKcz9GwC&pg=PA9&lpg=PA...

It was actually a clever "Slide to Jailbreak" rather than a click.

https://en.wikipedia.org/wiki/JailbreakMe

You're correct. jailbreak.me I think it was called

It was always amusing to visit the Apple store and see a jailbroken iPhone on display when this vulnerability worked.

And it was resurrected later on - by comex, I think.

Yep, it was a pdf parsing exploit I believe.

Yes, the stagefright vulnerability in Android (http://arstechnica.com/security/2015/07/950-million-android-...)

The stagefright bugs gave control over the media-player daemon of Android. This daemon is not running as root, it's even jailed with SELinux, but it has some interesting permissions like microphone-access.

Despite the media hype you can't root your phone with the stagefright bugs and so it wouldn't qualify for the bounty.

> Despite the media hype you can't root your phone with the stagefright bugs and so it wouldn't qualify for the bounty.

Alone? No. As part of a "chain" of exploits, which is what this bounty is calling for, in concert with a privilege escalation? Yes. That bug allowed for remote and silent (due to executing in a way which would allow it to suppress notifications of the incoming message) arbitrary code execution as a user on the device, which, even as a user with minimal permissions or which has been sandboxed in some way, affords you the ability to do much much more on the device than you could before the exploit.

FWIW, the actual release included a demo of rooting a device on stage; they have a video with a similar demo. I presume the second bug they were using was an already-fixed kernel bug, but if you have something like stagefright your next step is to go hunting for such a bug. (Regardless, the question you were responding to was more about how most of the exploits people put together do not satisfy the "remote" and "silent" parts, as opposed to the "I got root" part; the latter is comparatively easy.)

https://www.youtube.com/watch?v=PxQc5gOHnKs

> I presume the second bug they were using was an already-fixed kernel bug That's true, @jduck confirmed that on twitter. It's an old, fixed, bug that has nothing to do with stagefright and could be exploited by every app on the phone or every rce in any app on the phone.

> Regardless, the question you were responding to was more about how most of the exploits people put together do not satisfy the "remote" and "silent" parts, as opposed to the "I got root" part; the latter is comparatively easy

FWIW, "throughout the whole chain" was part of the question.

Some of those other interesting permissions are the ability to open arbitrary network/bluetooth sockets, read/write to external storage, and access the camera[1].

Mediaserver is not full root but it is pretty privileged. Given all of this access it wouldn't take much work to incorporate another privilege escalation bug to get root on the phone anyway, and there is zero user interaction.

[1] https://www.blackhat.com/docs/us-15/materials/us-15-Drake-St...

There isn't much in the list that applications like Hangout or Chrome don't have anyway. It's still a very serious vulnerability, but the overstating is just clever marketing by a security company.