Minutes 2026-04-09

Presentation by Simone on iOS Jailbreaking

• What is it?
  • Remove restrictions
  • Root access
  • Sideloading apps
  • Bypass code signing
• Tools
  • Cydia (old)
  • Sileo
  • Checkra1n
• iOS Architecture
  • Darwin kernel (derived from FreeBSD)
  • Enforces code signing
  • Apps are sandboxed
  • Secure boot chain (iBoot)
• How does it work?
  • Exploits
    • Bootrom exploits like checkra1n and redsn0w, which are usually unpatchable
    • Userland exploits through apps or tools, usually get patched very quickly
  • Attempt privilege escalation
  • Patch out kernel protections
    • Caries wildly by iOS version and device
• Types of jailbreaks
  • Untethered
    • Full reboot persistence
    • Died out by iOS 9
  • Semi-untethered
    • No reboot persistence
    • Requires an app to jailbreak each boot
    • Apps must be resigned each week
    • Most common type
  • Semi-tethered
    • Requires a computer to jailbreak each boot
    • Most bootrom exploits are this type
    • Computer tool overrides iOS boot chain
  • Tethered
    • Requires a computer each boot
    • Rare
  • Demo using iOS 10 on an iPhone 5S
    • Using browser exploit called Totally Not Spyware
      • Creates a popup saying the kernel was patched
    • Zebra is the package manager for this jailbreak
    • Reloaded into jailbroken state with theme
    • Hard crashed :(
    • After jailbreaking again, it reloads again and then died immediately.
  • What you can do
    • Install package manager
      • Cydia, Sileo, Zebra
      • Frontends for apt
    • Customization
      • Theming
      • UI modifications
    • Modify app or system behavior
    • SSH server
  • Jailbreaking is dead now
    • Modern iOS is much more secure
      • Signed boot chain
      • Page protection to stop kernel read and write
      • Pointer authentication code
      • Hasn't been a bootrom exploit in years
    • Can't downgrade iOS
      • Every iOS version is signed per individual device
      • SHSH blob must be saved to downgrade, but must be saved while still signed by Appled
      • Firmware incompatibilities
    • Apple hired prominent Jailbreak developers
      • Bug bounty programs
    • Apple added some Jailbreak features to stock iOS
      • Dark theme
      • Icon themes
  • Jailbreak compatibility
    • iPhone X and older
      • All versions vulnerable
      • Bootrom and software exploits
      • Devices are no longer supported by Apple
    • Newer devices
      • Userland exploits on iOS 17 and older
      • Generally don't exist now
  • Risks
    • Security risks
    • Can be unstable
    • Some apps will break
      • Games
      • Banking apps
    • Updating iOS usually patches the exploit
    • Legal grey area
      • Not exactly illegal
      • Violates Apple EULA