Helping Hackers In Discovering Vulnerabilities In iOS 5.1

Pod2g wants help

We reported recently that hacker Pod2g had started working on creating a jailbreak tweak for iOS 5.1. He said that he would be able to create a jailbreak after finding the vulnerabilities of iOS 5.1.

iOS 5.1 includes patches for the previous jailbreaks for both A4 and A5 devices.

Now Pod2g has another announcement to make. He is calling on the jailbreak community, or any iOS user to help him find bugs in Apple’s mobile OS by sending him crash reports.

Pod2g posted a guide to identify exploitable vulnerabilities to his blog on 12 March 2012. Have a look:

“How can I help the jailbreak community?

To jailbreak a device, hackers need a set of exploitable vulnerabilities:

*a code injection vector : a vulnerability in the core components of iOS that leads to custom, unsigned code execution.

*a privilege escalation vulnerability : it’s usually not enough to have unsigned code execution. Nearly all iOS applications and services are sandboxed, so one often need to escape from the jail to trigger the kernel exploit.

*a kernel vulnerability : the kernel is the real target of the jailbreak payload. The jailbreak has to patch it to remove the signed code enforcement. Only the kernel can patch the kernel, that’s why a code execution vulnerability in the *context of the kernel is needed.

*an untethering vulnerability : when the device boots, it is unpatched, thus cannot run unsigned code. Thus, to start the jailbreak payload at boot time, a code execution vector either in the services bootstrap or in the loading of binaries is mandatory.

You can help if you can crash either a core application (Safari, Mail, etc…) or the kernel in a repeatable way. A kernel crash is easy to recognize as it reboots the device.

*Important facts:

*Always test on the latest iOS version before reporting a crash (at the time of writing, iOS 5.1)

*Be sure to not report crashes to Apple : on your iOS device, go to Settings / General / About /Diagnostics & Usage, and verify that “Don’t Send” is checked.

*Not all crashes are interesting : aborts, timeouts or out of memory kind of crashes are useless. Verify the crash dump in Settings / General / About /Diagnostics & Usage / Diagnostic & Usage Data that the crash report you created is of *Exception Type SIGILL, SIGBUS or SIGSEGV.

*The crash should be repeatable, which means you should know what exact steps produced it and how to produce it on another device.”

Those interested in helping Pod2g are requested to send all crash reports sent to iOS.pod2g@gmail.com. You should make sure that the crash falls under one of the above-mentioned exception types. You should include the report, as well as the steps to reproduce it. Otherwise the data is useless.

Do you feel that Pod2g will be able to create a jailbreak tweak for iOS 5.1? Post your comments.

Source: iDownload Blog

Written by

The author didnt add any Information to his profile yet