I wonder if that backdo... ermmm... i mean... undocumented feature... will be useful for ios jailbreaking.
this post was submitted on 27 Dec 2023
37 points (97.4% liked)
Technology
58137 readers
5226 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
It’s gonna be a “yikes” from me, dawg
Shorter version: Operating systems set up hardware locks and protections to confine processes, and once set up, they cannot be undone. (the hardware + OS denies modifications to the security policy)
- Attacker broke out from the app sandbox. (attacker can run code in the infected process)
- Broke out of the process. (gained root access; attacker can run anything)
- Broke into the kernel space (gained 100% control over the hardware)
- Corrupted some kernel memory via a damm magic MMIO accesses nobody knows (hardware vulnerable)
- Bypassed protections that kernel set up earlier such that it cannot accidentally modify itself.
- Finally broke the kernel via hardware exploit thus the attacker got rootkit level access.
Getting arbitrary code execution and root access is one thing, but breaking out from the damm kernel configured hardware protections is insane.
They basically managed to flip a "read-only" switch to "modify-as-much-as-you-like". The infected device at this point is broken beyond repair, as the firmware(s) may have been tampered with. End result is a terrestrial spy brick.