update on jailbreaking progress

[RadicalxEdward]

The Vunerability

Mobile Safari on the iPod Touch and on the iPhone has a vunerability which could allow arbitary code execution. The vunerability is belived to be due to this problem, which is over a year old.

Currently there is a malformed TIFF file (tinyurl.com/ywjoxl) which will cause MobileSafari on all firmware versions of the iPod Touch and iPhone to crash. This file originated from the exploit that was used on the PSP


Current Status

Currently the Dev Team is working on a proof of concept which will hopefully lead to a jailbreak. The problem they are facing is writing a payload using raw ARM opcode without causing safari to crash.

The eventual target is to modify /etc/fstab so that /media will be mounted without the noexec flag. This should allow another payload to execute arbitary code without being restricted to a maximum size around the 50Byte mark.

[Mustachio]

dont understand any of that, but if its progress, cool.

[RadicalxEdward]

It means they want to crash safari in a very specific way in order to cause it to execute their own code.

[nintendodude]

thats cool, i wonder how a TIFF image is supposed to help us unlock the iPoT though...

[cowboyshootist]

Originally Posted by nintendodude

thats cool, i wonder how a TIFF image is supposed to help us unlock the iPoT though...

You replace the TIFF image with executable code so that when the image is loaded you get code in memory instead. Then you have to cause the application to read those memory locations and execute the code.

The concept is pretty straightforward, the impelmentation, on the other hand, can be fairly complex.

[1337chaos]

see tiff images have always been a problem... because you can hide code in the images themselves. the 2.0 psp's first discovered that tiff images could be used to exploit the system. just from one picture, you could change one number. from a 2.0 to a 1.0, making the psp think it was a 1.0, and therefore letting you run the 1.5 update to go from 2.0 > 1.5. if the same thing can be done here (however tiff decoders have been patched since then) it might lead to a breakthrough. if only that damn dev team wouldnt have told apple about that giant web browser exploit

[Mustachio]

Ahh i see... yea, so apple knows about the exploit... they would have found out sooner or later, in the meantime there is nothing they can do without releasing a new firmware, so... for the time being, rock on.

[sitric]

well. i am happy that we are getting some help from the PSP hacking community.... i've been active in that community for a long time and it is by far the most active community i've seen.

[danbolsom]

awsome I am so pumped for the final release of the jailbreaker!!!! when I saw this I was like DOOOOOOOOOD!!!! lol yeah. I never thought that apple would be as stupid as sony to allow a TIFF exploit

You would think that one company would learn from another companies mistakes but who is complaining this PWNS soooon many Noobs lol

[Beemer]

Lets hope.