A few days ago the recently iOS 6.1 jailbreak evasi0n tool was launched, and it seems that the new jailbreak is doing quite well, folks! Cydia’s creator Jay Freeman told Forbes that the tool has been used to hack 7 million iOS devices since its release a few days ago.
The abovementioned number includes 5.15 million iPhones, 1.35 million iPads, and 400,000 iPod Touchs – quite an impressive digits given the fact that evasi0n has been out for only four days now. It also handily explains Cydia’s staggering increase of server traffic.
As of Thursday night, Freeman’s alternative app store had received visits from 5.15 million iPhones, 1.35 million iPads, and 400,000 iPod touches that were jailbroken with evasi0n, the first jailbreaking software for the iPhone 5 and iOS 6.1.
Freeman says that evasi0n has brought Cydia “insanely more new traffic” than the release of the jailbreak tool called Absinthe that worked on some versions of iOS 5. And even Jailbreakme3, the popular web-based jailbreak released by iPhone hacker Comex in the summer of 2011, was only used on 1.4 million devices in its first nine days online.
Source 1, Source 2, Via
The evasi0n jailbreak was launched only a few days ago. More than 1.7 million iOS devices were jailbroken in the first 24 hours, according to Cydia’s download stats. What’s more – the half of that number was reached in mere six hours of the release of the jailbreak tool.
Of course, the simplicity of the jailbreak solution is tempting to many, and it’s easy to forget how much work actually went into creating this seamless hack tool. With every new iOS release and every new iOS device, Apple’s code quality and system protection only gets better. So these guys have overcome an enormous challenge.
Have you ever thought about how the latest evasi0n jailbreak actually works and what it took the evad3rds team members to overcome the hardened defenses of Apple’s latest devices? One of the team members, David Wang, a.k.a. @planetbeing, who was one of the two people who were personally responsible for finding the exploit in Apple’s code, sat down for an interview with fellow tech journalists and explained the whole process.
And here’s how evasi0n operates, as told by one of its creators :
- evasi0n begins by running libimobiledevice, a program that substitutes for iTunes to communicate with iOS devices via the same protocol as Apple’s program. Using that tool, Evasi0n exploits a bug in iOS’s mobile backup system to gain access to certain settings that it normally shouldn’t be able to access, namely a file that indicates the device’s time zone.
- The jailbreak program then inserts a “symbolic link” in that time zone file, a shortcut from one place in an operating system to another. In this case the link leads to a certain “socket,” a restricted communications channel between different programs that Wang describes as a kind of “red telephone to Moscow.”
- Evasi0n alters the socket that allows programs to communicate with a program called Launch Daemon, abbreviated launchd, a master process that loads first whenever an iOS device boots up and can launch applications that require “root” privileges, a step beyond the control of the OS than users are granted by default. That means that whenever an iPhone or iPad’s mobile backup runs, it automatically grants all programs access to the time zone file and, thanks to the symbolic link trick, access to launchd.
- iOS has another safeguard that would normally prevent any rogue application from gaining access to launchd: Code-signing. That restriction requires that all code run on a device is approved with an unforgeable signature from Apple. So Evasi0n launches a new app that appears to have no code at all–signed or unsigned. But when a user is prompted and taps the app’s icon, it uses a Unix trick called a “shebang” that can summon up code from another, signed application. In this case, it summons up launchd–which it can only access thanks to the socket change it made earlier–and uses it to run a “remount” command that changes the memory settings of the read-only root file system to make it writable.
- Now that the root file system is writable, evasi0n changes a file called launchd.conf that alters the configuration of launchd so that the changes evasi0n makes to it are repeated every time it runs. That’s what will make the jailbreak “persistent”: The user won’t need to re-run the program over a USB cable every time the device boots.
- Even after all those contortions, a device isn’t jailbroken until its restrictions are removed at the “kernel” layer–the deepest part of the operating system that performs the code-signing checks to prevent running unapproved apps using a process called the Apple Mobile File Integrity Daemon (AMFID). So evasi0n uses launchd to load a library of functions into AMFID every time a program launches that somehow swaps out the function that checks for a code signature for one that always returns an “approved” answer.
- iOS has yet another safeguard to prevent hackers from altering memory in the operating system kernel: Address Space Layout Randomization, or ASLR. That defensive trick moves the location of device’s code in its flash memory a certain, random distance every time it boots up to stymie anyone who would write over a particular part of the code. But evasi0n uses a memory allocation trick to locate one spot in memory that’s harder to hide in ARM-chip-based devices, known as the ARM exception vector. That part of the kernel handles application crashes, reporting on where in memory they happened. So evasi0n simulates a crash and checks the ARM exception vector to see where the crash occurred, providing just enough information to map out the rest of the kernel in the device’s memory.
- Once it’s beaten ASLR, the jailbreak uses one final bug in iOS’s USB interface that passes an address in the kernel’s memory to a program and “naively expects the user to pass it back unmolested,” according to Wang. That allows evasi0n to write to any part of the kernel it wants. The first place it writes is to the part of the kernel that restricts changes to its code–the hacker equivalent of wishing for more wishes.
Another, more detailed and more technical rundown of what happens when you jailbreak your iOS device, can be found here. What these guys did looks like an amazing feat and we hope their solution will stick around for a while before Apple strikes back.
Source 1, Source 2, Via
Evasi0n was finally released to free all iOS 6.0/6.1 devices (iPhone 5 and latest iPads included) and it’s being enjoying some serious popularity. In fact so many users have jailbroken their iDevices that Cydia servers are unable to catch up with the demand.
The numbers are insane – Cydia creator Jay Freeman (saurik) has shared on Twitter that he’s seeing 14 thousand hits per second.
Meanwhile pod2g, one of key developers behind evasi0n has posted numbers on his blog for evasi0n.com. The site is getting close to 3 million unique visitors and over 17 million pageviews.
Users are reporting that Cydia isn’t able to install its repository on their devices due to the overwhelming traffic, which causes server hiccups. So you guys (and some of us here too) will just have to be patient until things get back to normal – it might take at least a few days, given how long the world waited for an iOS 6 jailbreak.