New iOS Jailbreak Tool Works on iPhone Models iOS 11 to iOS 13.5

Latest version of UnC0ver uses unpatched zero-day exploit to take complete control of devices, even those running iOS 13.5.

A hacker team has released a new method to jailbreak iPhones that they claim uses a zero-day exploit that allows them to jailbreak iPhones running iOS 11 through Apple’s most recent version of its mobile operating system – iOS 13.5.

Calling it a “big milestone for jailbreaking,” one of its creators, a hacker called Pwn20wnd, heralded the new jailbreak release on Twitter, claiming it’s the first zero-day jailbreak for the iPhone platform since iOS 8.

Hackers did not disclose the details of the unpatched iOS flaw their tool relied on. One report on Vice Motherboard said the jailbreak takes advantage of a kernel vulnerability. No matter, the hacker team expect Apple to eventually patch the flaw which is just the “nature” of the business, Pwn20wnd said in the report.

“Even when they release a patch, users can downgrade to the previous iOS version for about two weeks usually, and after that, the users should stay on their versions so that the jailbreak keeps working,” according to the hacking team’s report of the jailbreak posted to the Unc0ver website. The jailbreak only works on iPhones running iOS 11 through iOS 13.5 and does not work on iOS versions 12.3 to 12.3.2 and 12.4.2 to 12.4.5.

The new jailbreak enables “unrestricted storage access to jailbreak applications for sandbox backwards compatibility,” while leaving security restrictions enabled for system and user applications in place, the team said. The new tools also update Phone Rebel case models and bundled packages.

Jailbreak tools are software that take advantage of vulnerabilities in iOS to allow users sometimes full control of their device. Jailbreaking bypasses DRM restrictions, allowing users to run unauthorized and custom software as well as make other tweaks to iOS.

Apple’s iOS are closed-source. The company historically has cited security reasons for not permitting its users to tinker with the proprietary code for iOS. However, jailbreaks have become popular ways for iOS developers and users to hack into their own devices to make custom changes.

“Allowing you to change what you want and operate within your purview, unc0ver unlocks the true power of your iDevice,” the Unc0ver team boasted on the tool’s download page.

While this may be true, jailbreaking an iPhone also creates serious security concerns, as it can make jailbreak devices susceptible to rogue or unstable apps downloaded from outside of Apple’s curated App Store. While potentially the new tool’s feature to leave security restrictions in place could remedy this risk, it’s difficult to know at this time if that will make a difference.

Just because security researchers highly discourage the practice doesn’t mean iOS developers and users will listen, given the enthusiasm with which they met the release of the new Unc0ver tool. Their interest was so keen that the download site crashed not long after the release, Vice Motherboard’s Joseph Cox said on Twitter.

Developers also widely applauded the tool on the social-media platform upon Pwn20wnd’s announcement of its release.

“I’d like to congratulate you man you’ve done great for the community for the past 3 years and today will be the biggest release of them all,” developer Kaleb Davison (@drdavison5) tweeted.

Another Twitter user @IOSblaraby tweeted that the release is “a big hit for Apple,” citing its ability to crack even the most recent release of iOS.

Concerned about the IoT security challenges businesses face as more connected devices run our enterprises, drive our manufacturing lines, track and deliver healthcare to patients, and more? On June 3 at 2 p.m. ET, join renowned security technologist Bruce Schneier, Armis CISO Curtis Simpson and Threatpost for a FREE webinar, Taming the Unmanaged and IoT Device Tsunami. Get exclusive insights on how to manage this new and growing attack surface. Please register here for this sponsored webinar.

Suggested articles

Discussion

Leave A Comment

 

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Subscribe to our newsletter, Threatpost Today!

Get the latest breaking news delivered daily to your inbox.