Apple + Malware + Recommended
iOS 9 Is Finally Jailbroken, but Should You Do It?
Posted on
by
Graham Cluley
Earlier this week Pangu Team, a group of Chinese hackers famous for their jailbreaking activities, announced that they had released to the public the first iOS 9 jailbreak, breaking the operating system away from the tight control of Apple.
Of course, this should be impossible. But time and time again vulnerability researchers have found ways to jailbreak iOS, despite Apple’s best efforts to police the operating system and stop what the firm sees as unwanted meddling.
Why would you want to jailbreak your iPhone or iPad?
Well, maybe you want to have the option of installing apps that haven’t been allowed into the official App Store, or adding tweaks and functionality to the operating system that Apple hasn’t yet adopted. That’s fair enough, in my opinion — after all, you have shelled out a large amount of money to own the device, but you should be aware of the potential security implications of jailbreaking.
I have previously explained why I felt that the arguments for jailbreaking your iPhone were less convincing than they used to be, and that jailbreaking your iPhone or iPad ran the danger of opening you up to the risks of attacks such as iOS/KeyRaider, the state-sponsored Cloud Atlas malware and Chinese hacking gangs hell bent on making money by hijacking app ad revenue.
The truth remains that if you are installing apps from other unauthorised sources then you are also not benefiting from the vetting that Apple’s security team does before granting apps the rights to be distributed through its marketplace.
Malware for iPhones and iPads is still extremely rare, and most of what has been seen has targeted jailbroken devices.
Another reason why you want to jailbreak your iOS device has more sinister overtones than simply gaining access to a wider selection of apps.
Perhaps the iPhone or iPad you wish to jailbreak doesn’t actually belong to you at all — maybe, instead, you want to install some spyware on it to monitor the movements and communications of, say, an ex-partner. Making modifications to someone else’s device in this way, without their permission, is undoubtedly illegal in many countries, but that’s not to disguise the fact that it is surprisingly commonplace.
It goes without saying that in a corporate environment jailbroken iPhones are likely to be frowned upon by your IT security team.
Regardless of your motivation for jailbreaking, the Pangu tool is now here and capable of jailbreaking your iDevice.
iDownloadblog published a YouTube video showing just how easy it was to jailbreak gadgets running iOS 9 using the Pangu tool, which has to be run on a Windows computer.
It certainly seems like a fairly straightforward process, but fortunately, for the security-conscious, the latest Pangu jailbreak cannot be achieved remotely.
Anybody wanting to jailbreak your iPhone running iOS 9 needs to have physical access to the device and will need a Windows PC running the Pangu jailbreaking tool to bypass iOS’s security. That clearly won’t be a big challenge to jealous partners trying to snoop, but might prove more of a hindrance for traditional online criminals.
iOS 9 was expected to pose an even greater challenge for the jailbreakers than previous incarnations of the operating system, as it incorporates a kernel-level feature called Rootless that is designed to secure sensitive data and prevent malware intrusions.
(By the way, a version of Rootless has also been built into OS X 10.11 El Capitan, iOS’s larger desktop and laptop-based operating system cousin.)
Although Rootless appears to have been waltzed around by the latest jailbreak code, there is no suggestion that its protection is worthless. The fact that jailbreaks are becoming increasingly newsworthy indicates just how much of an effort it has become to circumvent Apple’s built-in security.
Indeed, just last month vulnerability broker Zerodium announced that it was offering a jaw-dropping one million dollar bounty to anyone who provided them with exclusive access to a browser-based, and untethered jailbreak for iOS 9.
In a tweet, Chaouki Bekrar of Zerodium confirmed that Team Pangu would not be eligible for the huge reward:
For those asking: Pangu iOS9 jailbreak is *not* qualified for @Zerodium bounty because: 1) it's not remote 2) it's publicly available
— Chaouki Bekrar (@cBekrar) October 14, 2015
That’s hardly surprising news, as Zerodium would want exclusive access to any jailbreak in order to sell it on to intelligence agencies, and additionally the most attractive exploit (to those types of customers) would be ones which did not require physical access to the targeted device.
So, Pangu has proved that iOS 9 jailbreaks remain possible, and no doubt Apple will work to prevent this jailbreak from succeeding in a forthcoming update.
The central question for you should be, is it worth jailbreaking your iPhone or iPad? And, I hope for most of you, the sensible answer is probably “No.”
