News for hackers. Stuff that matters.

A comment on Checkm8 – Bootrom exploit for many iOS devices. Parent comment

Re:Checkm8 – Bootrom exploit for many iOS devices by mstg on Friday September 27, 2019 @09:40AM (#21091809)
iBoot and BootROM is different. iBoot is software (patchable) while BootROM is read-only. Otherwise, agree! It's really a big achievement.
[ Parent | on HN ]
Re:Checkm8 – Bootrom exploit for many iOS devices by roblabla on Friday September 27, 2019 @09:48AM (#21091923)
I'm very confused. On one hand, the tweet claims to have a bootrom exploit. On the other hand, the fifth tweet in the chain talks about an iBoot vulnerability that got patched in ios12 beta[1].

Maybe the vulnerable codepath has some code sharing between iBoot and SecureROM?

[1]: https://twitter.com/axi0mX/status/1177544539046703104

[ Parent | on HN ]
Re:Checkm8 – Bootrom exploit for many iOS devices by comex on Friday September 27, 2019 @06:08PM (#21096694)
> Maybe the vulnerable codepath has some code sharing between iBoot and SecureROM?

It does.

[ Parent | on HN ]
Re:Checkm8 – Bootrom exploit for many iOS devices by mstg on Friday September 27, 2019 @06:33PM (#21096862)
Comex himself has spoken! It turns out I definitely didn't understand it correctly. Thanks for the clarification!
[ Parent | on HN ]
Re:Checkm8 – Bootrom exploit for many iOS devices by bumblebritches5 on Friday September 27, 2019 @06:42PM (#21096930)
Do you have iBoot's source code from the leak a while back?
[ Parent | on HN ]
Re:Checkm8 – Bootrom exploit for many iOS devices by null_auspices on Sunday September 29, 2019 @04:33AM (#21105888)
https://github.com/PUNISHMENT-POSSE/Apple-iOS-9-Source-Code
[ Parent | on HN ]
Re:Checkm8 – Bootrom exploit for many iOS devices by mstg on Friday September 27, 2019 @01:41PM (#21094350)
If I've understood this correctly, it was an iBoot vulnerability enabling the exploitation of the BootROM vulnerability untethered (without connecting to a computer again). Since the iBoot vulnerability is patched, the phone has to be connected to a computer every time to boot if there has been any tinkering (custom FW or any change in boot sequence).

So prepatch you could exploit the BootROM vulnerability untethered with the iBoot vulnerability, but postpatch have to connect to a computer to boot every time if you have done any tinkering which is why it is currently only adviced for security researchers. Tinkering with the BootROM also leads to invalidations of APTickets (so a future restore may be impossible without special gear).

[ Parent | on HN ]