This is obviously wrong. It's possible to do the same banking things using the bank's website both from general purpose PCs and browsers on phones for which jailbreak detection is not possible in the browser.
Jailbreak detection is done by testing for the presence of common things that allow the device owner to control the device. The device owner controlling the device is not a problem for banking. Meanwhile a malicious third party wouldn't inherently need to make use of any of those and would have strong incentives to avoid using any that trigger jailbreak detection, so it's no help there either.
And for the same reason it's basically useless for detecting cheating. Because if you jailbreak your phone so you can install some apps from outside the store and then it breaks your games, you might grumble and decide you want to play the game more. But if you jailbreak your phone because you want to cheat at games, your next step is to thwart the jailbreak detection, which is not that hard when you have the game software to inspect to see how it's doing jailbreak detection. And you can also tell when the app is updated and then run the new version on a test machine to see how the new version is doing jailbreak detection.
It's hostile and a waste of time to do this when you're going to lose anyway. You only inconvenience the people who jailbreak their phones for completely unrelated reasons.
Which isn't the case here. A device controlled by the owner isn't less secure than one that isn't. It's only a device controlled by an attacker that is. But "jailbreak detection" only detects the former (when it even detects that) and not the latter.
The fact that you can do banking on the web only proves that banks admit that you don't need a device the owner doesn't control in order to do banking.
The jailbreak community is usually quick in introducing patches for security vulnerabilities.
The most recent Mail bug [1] had a patch released 29 days ago [2]. Apple only introduced a fix in a 13.4.5 beta, and it's unsure if the same fix was put into 13.5 [3].
Admittedly, it'll be even better if the community strongly encouraged the installation of such tweaks in Cydia et al.
[1] https://blog.zecops.com/vulnerabilities/youve-got-0-click-ma...
[2] https://www.reddit.com/r/jailbreak/comments/g7eujh/release_m...
From trying to roll their own crypto, to still using legacy ssl to support ie6...everything is shitty.
Even when they are forced by law [1] to integrate modern 2FA, they find ways to implement it in a shitty, proprietary way.
PSD2 is required since September 2019 and every single bank rolled it out in August and waited until the very last moment.
I mean, a photoTAN device with a 120x120 camera resolution? Seriously, what is this? 1999? Why not use RFC 4226 or RFC 6238 [2] [3]?
[1] https://ec.europa.eu/info/law/payment-services-psd-2-directi...
Windows XP and IE6 have been out of support for quite a while. They've long been dropped in favor of windows 7 (LTS support until 2023) and 10 more recently, which comes with internet explorer 10 or 11.
SSL would be quite easier to keep up-to-date if Microsoft actually upgraded their operating system and applications to support TLS 1.2 by default, which they don't for retro compatibility reasons.
For reference, working at JP Morgan, I can tell you that the company has dropped support for Internet Explorer entirely. Half of the existing internal apps don't even load on IE. Would be nice of vendors to stop wasting their time praising IE support as a feature.
Windows 8.1 has support until 2023. Windows 7 support is over since January 14, 2020. https://support.microsoft.com/en-au/help/13853/windows-lifec...
TOTP (RFC 6238) or HOTP (RFC 4226) are less secure than photoTAN/chipTAN because they are phishable, as in you can think you authorize a 30€ transfer for an internet purchase while in reality it's a 30000€ transfer to some bad people. photoTAN/chipTAN on the other hand are challenge-response based and send data about the transaction to the second factor device so that you can verify it before confirming.
Actually, this statement is not true, as those transactions and their payloads are not cryptographically signed and neither are they verified anyhow [1] [2]. Attackers or malicious activities on Android can easily modify the payload and still have a valid transaction for the end-user; showing up the wrong IBAN, wrong amount and wrong recipient. This applies to both the official banking apps and the photoTAN generator devices that Cronto is (re-)selling.
Note that the research was made public and reposted/printed in a _lot_ of newspapers in 2016. And of course, nothing got improved.
If you search the web for Uni Erlangen (FAU) and the "crypto" analysis, you'll find out that Cronto / CrontoSign is the software supplier for pretty much every major bank.
And yes, it's patented, and yes, other frameworks got taken down on GitHub for copyright infringements when they tried to reverse engineer it.
The only open implementation of the HBCI 2.2 / FinTS 3 [3] standard that I personally know of that hasn't been taken down already is libfintx [4].
[1] (German) https://www.fau.de/2016/10/header/phototan-banking-nicht-sic...
[2] https://faui1-files.cs.fau.de/filepool/projects/matrix-code/...
Your linked sources [1] and [2] don't really cover that topic. They mainly cover the use of Android apps and highlight the danger that the Android devices might be hacked, recommending use of dedicated devices. From [2]:
> Last but not least, please note that the photoTAN procedure is not only available as a smartphone app but also as dedicated hardware (Cronto, 2011). Naturally, our statements about the security features of app-based authentication cannot be transferred to thephotoTAN hardware device. Quite the contrary, a dedicated photoTAN device — available for all three analyzed banks — offers excellent security properties largely similar to those of chipTAN.
But this wasn't your point. It might very well be that the transaction data is not verified by the generator devices and only displayed, but your sources don't state it.
In my experience, this is not always the case. Some banks treat their mobile devices as more secure than website. For example, some actions would prompt an SMS MFA (I know, I know) if initiated from the website, but go right through if initiated from the app. It makes some sense, as on the app, they have access to things like location which they can use to make a better assessment on whether a request is fraudulent.
Neither of those are present when logging into your bank from its website, and I would also suspect that jailbreaking a phone significantly reduces the trust you can have in either.
Also, from a bank's perspective, all they care about is reducing their liability, without inconveniencing too many customers. In that context, it makes a lot of sense for banks to disallow their products from being used on jailbroken phones.
It implies they should at most only require SMS to use the app on a jailbroken phone. Or, you know, stop doing that entirely, since SMS-based authentication is horrifyingly insecure. It's literally less secure than email, and that's a pretty low bar. People should really stop using it.
Also, phones have no real way of authenticating their current location, so assuming that what the phone tells you is secure against intentional fraud is a pretty bad idea to begin with.
I'm pretty sure jailbreaking is bad for developers who want to sell nice, simple, pay up front no surveillance software, because that is primarily threatened by the very piracy jailbreaking enables.
You might imagine jailbreaking is all about giving people control or whatever. Ultimately it just means, due to piracy, that the only people that are allowed to make money off software is Google and Facebook, through ads, or other companies, which just routinely abuse the spirit of open source to monetize other people's work.
Unless you're of the frankly radical opinion that anything that costs money is bad, and everything that is free is automatically better, and that the whole app ecosystem, that pays out like billions a year to actual, bonafide human beings writing software, could be instead totally supplanted by free websites. Then of course what I'm saying makes no sense.
Yeah, whatever. Who wants to have control over their device anyway? Much better if Apple gets to decide what I do with my iDevice. Not sure why Microsoft hasn't started the same approach, at least Linux distributions discourage people from installing software outside of the repositories, but there is much work left to be done in actually making that impossible. At least the latest innovations in home computing, smart speakers, don't allow you to run anything at all other than what the makers intended. It's great for privacy if you can't do insecure things.
...
Privacy and control really are much more synonymous than at odds with each other. Sure, allowing someone to shoot themselves in the foot is something you'll want to minimize happening, but if they can't shoot themselves in the foot when they really try very hard, then how much control do they have over their private life really?
> jailbreaking is bad for developers who want to sell nice, simple, pay up front no surveillance software
I fail to see how this is explained by the "because" that comes after it. It just makes zero sense: why would a user taking control be bad for the developers if they don't want to surveil your device anyway? They already have the money up front, as you say. Wouldn't it make more sense to expect something to be mine after I paid for it up front?
> Unless you're of the frankly radical opinion that [something exaggerated to the point where it's clearly illogical]. Then of course what I'm saying makes no sense.
I'm not sure what you're trying to say here. Anyone who disagrees must be of this weird opinion and there can be no other viewpoints: either you're with you or you're illogical and "radical"?
Heh, I suppose you've got me there: I indeed don't buy devices that don't allow taking control by design. But I know there are a lot of people that like other parts of the iOS ecosystem (apps are often more polished; they might be more used to the OS; etc.) and would prefer to keep those while still having having their four freedoms on the device.
That's quite a bold statement, and also not correct in my experience. Take for example NFC payments. Both Apple and Google will disable the mobile wallet if they detect that the phone has been rooted / jailbroken.
Both Apple and Google have a conflict of interest there, so that proves nothing about the security and everything about their perverse incentives.
How does it even make sense? It's safe for me to use the website from a jailbroken phone to transfer thousands of dollars to the account of a foreign national but not safe to use a jailbroken phone to pay $3 for a cup of coffee in a restaurant I'm physically standing in?
According to reddit, Apple Pay works on jailbroken devices, but still, something like this might be at play in all the other similar scenarios.
I can confirm that Apple Pay works on my jailbroken devices, and as far as I can tell, no jailbreak has managed to affect the Secure Enclave.
> And iirc Apple managed to convince the banking sector that Apple Pay is equivalent to chip card security, so that they get better rates.
It's not possible right now AFAIK but that doesn't mean it might not be possible later.
The main point I'm trying to make though is that mobile devices support NFC payments with virtual cards in wallets that are protected by Apple/Google. That's not a use case that is supported on regular PCs, so it's not unreasonable that the security requirements are different.
Any reasonable system (i.e. one using public key cryptography) does not allow the attacker to "clone" your virtual cards at all, because they don't have your private key, which never leaves your device. And if they've compromised your device (not their own) sufficiently to extract your private key then the game is over and you've already lost.
Once they have the private key they don't need a jailbroken phone running the official app, they can just speak the NFC protocol directly to the reader and sign with the victim's private key.
> The main point I'm trying to make though is that mobile devices support NFC payments with virtual cards in wallets that are protected by Apple/Google. That's not a use case that is supported on regular PCs, so it's not unreasonable that the security requirements are different.
The difference is that the security requirements should be lower, since it's only used for in-person purchases. Even if the attacker somehow has your private key, to use NFC they would have to show up in person, smile for all the surveillance cameras and risk getting arrested on the spot if the card has already been reported stolen.
I don't see the argument for why security requirements should be lower in that case. Security cameras are not always present and getting arrested "on the spot" for a virtual card theft seems unlikely given the nature of the crime (it seems doubtful police forces would have officers standing by for this purpose that are able to both detect and react quickly enough).
(something not done with a laptop)
There is no spending limit. Protection is important.
You're making a poor argument based on nothing more than a loose generalization.
A jail broken/rooted device may not have the same protections since jail breaking is typically circumventing that sort of threat protection.
So your argument is that walled garden devices are less secure assuming there exist methods to convert it into a general purpose computer, which they empirically do.
Shouldn't this be an argument for such devices to be less trusted? After all, you can't always tell when this has happened (so you better assume it has), whereas as you say the devices designed to be operated under that threat model would then be more secure.
I absolute agree that a user, as the owner of the phone, should be able to do this, especially in a safe and official manner. Right now it’s an all or nothing and that is a problem.
If it was jail-breakable, that security was never there in the first place.
It’s not really the same as a random piece of JavaScript on a webpage jail breaking your phone. I think having a rootable device doesn’t inherently mean your device is insecure.
Heh this was actually the case for a couple of Safari-based jailbreaks, all the way up to 9.3.4: https://en.wikipedia.org/wiki/JailbreakMe
Would you do banking on a random computer?
The three largest ransomware vectors are people leaving RDP exposed to the internet, phishing emails to get login credentials that are then used to gain access to internal systems, and vulnerabilities in existing software. None of those requires the user to install third party malicious software.
> Would you do banking on a random computer?
Would you do banking on a random iPhone? I wouldn't. There have been more than enough vulnerabilities that you have no way to know if it has already been compromised.
https://www.digitaldefense.com/blog/top-3-attack-vectors-ran...
I just searched for “ransomware” on Google.
MalwareBytes
“One of the most common methods today is through malicious spam, or malspam, which is unsolicited email that is used to deliver malware. The email might include booby-trapped attachments, such as PDFs or Word documents. It might also contain links to malicious websites.”
PCs and Macs are “insecure by design”. Anything that the user runs has full access to the users files and applications - without administrator access. How could this possibly be more secure than your typical iOS device? We have over 30 years of evidence of what happens when the typical user is able to install software that has free reign on their computer.
“ Malvertising often uses an infected iframe, or invisible webpage element, to do its work. The iframe redirects to an exploit landing page, and malicious code attacks the system from the landing page via exploit kit. All this happens without the user’s knowledge, which is why it’s often referred to as a drive-by-download.”
The browser is also another application that is not sandboxed on personal computers. Any security vulnerability in the browser leaves the computer vulnerable.
Notice that most if not all mobile ransomware affects Android devices?
Ah, yes, the same kind of software that forbids pasting passwords, because, security.
Although, to be fair, I must admit, the comparison is not entirely accurate. It is true that it makes some sense. I don't know about iOS jailbreaks, but on Android an application may request superuser privileges. Given that a significant fraction of users do tend to grant arbitrary permissions to see the flying pigs (numerous Android flashlight apps are a good example), I can see how this could be a problem. I believe I've heard of malware that does this.
That's why my latest Android phones haven't had user-facing root access or Xposed. The idea was that there was nothing installable/programmable (that I could grant by fat-fingering or someone could borrow/steal my phone and exploit the elevated capabilities) - just a custom-built firmware with everything I needed. I haven't yet felt a particular necessity to jailbreak my iPhone (although apps get worse every year so I may eventually consider it), so no experience in that regard.
Wait, you're worried you'll give something root without noticing? I can understand if you're worried about your mom doing that if you rooted her phone, but yourself?
(About rooting one's mom's phone, anecdotally I wish I had done that. She keeps getting notifications from Sony, the manufacturer, and things are just not customizable to suit her. When my grandma got a new smartphone a bit more recently, I rooted hers and then just set the supersu default to deny so she'd never get the prompt, and she's much happier with her phone. I've been considering rooting my mom's but the device wipe is such a pain, especially since you can't do app data backups without root (another reason to root: make actual backups). Android really needs an Apple iTunes-like backup system.)
TBH, I just didn’t need root access “on the go” - so, when I’ve decided I wanted to build my own image, I just haven’t found a reason/use case to include it. I had the full flash backups, an adblocker, a patch for clipboard read permission and a few UI customizations. And ability to add more stuff. That was all I needed.
A shame I had no control over bootloader and wasn’t able to truly lock down the device to my own signing keys.
Detecting root and jailbreaks isn't something developers do just to prevent power-users from using their devices, or because they think power-users are shooting their security in the foot, it's about stopping malicious actors from attacking regular users.
For example a piece of malware could achieve root and use it to read sensitive data from memory and log the user's inputs, including passwords and PIN codes. Malware has achieved root in the past, see the CopyCat malware on Android from a few years ago.
This also applies to features like Secure Boot. It's not just there to make power-users' lives harder. Without it, a malicious party could, for example, buy a bunch of smartphones retail, flash them with a malicious ROM, sell them at a loss, then recover the loss by stealing money using the victims' information.
These things also just break the security model of the platform they're on. It's hard to write a secure application when all the building blocks you're using could collapse at any time. Imagine writing a secure messaging app where someone could just replace all your crypto primitives. Wouldn't be easy, would it?
But we do have to wonder if the upsides outweigh the downsides. Someone surreptitiously stealing and replacing a smartphone to install malware on it can happen, but will that ever be common? Someone could also surreptitiously install malware on a laptop, but I don't hear of that happening a lot. I don't know of any banking trojan that is typically installed via physical access.
Do we want a world where people have no real ownership over their device anymore for this attack vector that has existed since day one but is rarely abused in the sort of attack that we're trying to prevent, or do we prefer a maker community to be able to exist? For example, F-Droid could not exist without Android allowing people to install software without needing Google's approval. A large part of the open source Android software is there and it's already fairly small due to the limitations that Android already put in place (F-Droid is large enough that I can replace nearly any apps with an open source alternative, but it's nothing like the community behind a Linux distribution).
It's also not just banks. Indeed, banks might not care about restricting users other than as a means to minimize risk, but Google certainly has an advantage if everything has to go through them. And I understand the developers agreeing to code it up: they're not evil people, they are themselves and they know they and their colleagues aren't evil. Of course they would allow any reasonable app in the app/play/whatever store and people can enjoy the platform without worry. I see their perspective, but there's a bit more to it than that ideal.
It’s kind of impossible, is it not? Why try futile efforts to “detect” this?
Practically though, it's exactly as we see here: a kind of arms race or cat and mouse game where the attackers circumvent the detection and the detection evades the circumvention.
So no, I don't think it's futile.
So all they're doing is detecting false positives from innocent people and zero instances of real malware.
(If there's an app that's truly essential for you, I'm sorry, that's a shame. But I haven't encountered that in my many years of using Jailbroken iPhones.)
And since these are all tethered jailbreaks, I don't want to completely re-install a banking app that locks itself up after I open it in unjailbroken mode (so the hider isn't working, but their jailbreak detection still does) after my phone dies and I forgot to re-jailbreak it.
They aren’t tethered completely. More semi tethered. I haven’t reconnected any device to a computer to re-jailbreak in many months. Most devices can use unc0ver. In which case you have to be Un-jailbroken for close to 7 days in a row for ReProvision to not renew unc0ver.
So that issue is a pretty big rarity.
If you are truly root, and the apps are not, then it's theoretically always possible to give them "the reality they want to see".
> The biggest downside is that you might find some existing apps on your phone can detect that the phone is jailbroken and refuse to start.
So the biggest downside is a problem completely caused by humans on purpose?
> There are obvious security reasons for apps like banking apps to do this but also many online gaming apps won't run if they detect that the device is jailbroken in order to deter cheating.
The gaming thing is irrelevant to me. I'm not going to sacrifice actually owning my device so that I can play games. As for banking it only matters if you lose your phone (if it's not encrypted) or if you give root access to a malicious piece of software. But even then, why should it matter? Your banking app should still be secure, but it allows the developers to be lazier. You can also log into your banking site through a web portal on your phone anyway even if you have root access so it's completely arbitrary to disallow access to an app on your phone. And the fact that it's checking for that anyway creeps me out.
Why is that everyone has has root/administrator access to their PCs but they are perfectly with using another computer that happens to be portable and not have root access. You supposedly own your phone, but if you don't have root access to it, I don't consider that as ownership. Whoever has root access to your phone owns it.
> There's an ongoing arms-race between app developers and jailbreakers where jailbreakers try to avoid detection and app developers find new ways to detect jailbreaks. So a new jailbreak will probably not be detected until a few weeks or months later when the app is updated.
That's great. A pointless arms race that's a waste of people's time. I'm glad the developments in a real Linux phone are picking up. I'd rather be in full control of the software that runs on my device instead of relying some corporate overlords babysitting me.
How has that been working out for the last 20+ years for the average consumer? How much more careful are you about installing random crap on your computer compared to your typical iOS device?
There are exactly zero reasons why a bank should be doing this and I would be quite pleased if Apple instituted rules against doing this kind of fingerprinting.
I don’t blame them, they’re mitigating another potential risk. Malware that’s essentially a rootkit could send your bank login details to a malicious third party in realtime, for example. 2FA codes and all.
Also remember there are lots of people out there that aren’t as tech savvy as the HN readership. A random person that just wants some springboard tweaks or similar may not verify where these tweaks came from & not understand the consequences of installing essentially untrusted software.
This is 100x worse in browsers on desktops, where the percentage of people who install things like browser extensions or persistent malware is non-neglible. Yet banks largely accept that as OK, and if someone’s bank’s website decided to probe the filesystem for “evidence” of malware would 1. cause a huge scandal and 2. immediately cause malware to hide itself from the detection.
I haven't used it myself, but two very similar kernel-level jailbreak detection bypasses were just released for unc0ver 13.x, FlyJB and KernBypass: https://github.com/akusio/KernBypass-Public
A couple of my banking apps detect my jailbreak but allow me to continue after hitting "Okay". The only app I ever wanted to use that refused to let me in was the Nintendo Switch Online app. Steam works fine. If you don't play games on your phone it isn't really a big deal imo.
One of those cases where a bug really is a feature
regarding the detection and added security - this is security through obscurity which has more downsides than protection it provides. not discussing the loss of privileges for device owner
Having said that, unless there's something specific you're looking for, it's not really worth the effort these days and has potential downsides.
The biggest downside is that you might find some existing apps on your phone can detect that the phone is jailbroken and refuse to start. There are obvious security reasons for apps like banking apps to do this but also many online gaming apps won't run if they detect that the device is jailbroken in order to deter cheating.
There's an ongoing arms-race between app developers and jailbreakers where jailbreakers try to avoid detection and app developers find new ways to detect jailbreaks. So a new jailbreak will probably not be detected until a few weeks or months later when the app is updated.
Source: I used to work for a company that makes phone software that needs to be secure and so would attempt to detect jailbreaks.