Leak of iBoot code to GitHub could potentially help iPhone jailbreakers [Updated]

On the evening of February 7, Motherboard's Lorenzo Franceschi-Bicchierai reported that code from the secure boot-up portion of  Apple's iOS mobile operating system—referred to as iBoot—had been posted to GitHub in what, according to Motherboard, iOS internals expert Jonathan Levin described to the website as "the biggest leak in history.”

That may be hyperbole—and Levin has since claimed he never said such a thing:

People - I never said it’s “the biggest leak in history”. I’m sure MSFT and EFX would disagree too.. but yeah, this is huge.

— Jonathan Levin (@Morpheus______) February 8, 2018

The leaked code has since been removed by GitHub after Apple sent a Digital Millennium Copyright Act takedown request. But the leak—which has been floating around the Internet for about a year, first being posted on Reddit— may still have implications for Apple mobile device security, specifically as an assist to those trying to create exploit software to "jailbreak" or otherwise bypass Apple's security hardening of iPhone and iPad devices. A search found several other copies posted on GitHub (for now), including one with instructions and instrumentation for "fuzzing" the code with tools designed to discover weaknesses in the code. However, it's highly unlikely that any bug discovered would be exploitable by an attacker seeking to break into the phone, because of the way Apple has layered the security of iOS devices.

The DMCA notice required Apple to verify that the code was their property—consequently confirming that the code was genuine. While GitHub removed the code, it was up for several hours and is now circulating elsewhere on the Internet.

The iBoot code is the secure boot firmware for iOS. After the device is powered on and a low-level boot system is started from the phone's read-only memory (and checks the integrity of the iBoot code itself), iBoot performs checks to verify the integrity of iOS before launching the full operating system. It also checks for boot-level malware that may have been injected into the iOS startup configuration. This code is a particularly attractive target for would-be iOS hackers because it has provisions for interaction over the phone's tethering cable.

In the event that  someone were able to discover a vulnerability in the iBoot code, they could theoretically break that security check, allowing unsigned code or code with a forged signature to be executed as iOS boots up. This could allow for "jailbroken" versions of iOS to be loaded and for non-App Store applications (and malware) to be installed on the phone. But such a hypothetical vulnerability is unlikely to allow an attacker to bypass the cryptographic security on the iOS device itself, so it may be of less use to individuals trying to bypass a phone owner's password or PIN.

[Update, February 9] But as Will Strafach. a mobile security expert and founder of verify.ly  pointed out in an interview with Ars, it's highly unlikely that the source will provide anyone with aa way to exploit the code. "It does not help much" with jailbreaking, he said. And much of the way iBoot works had already been reverse engineered by internals experts, he said. "The iBoot code is in C, so this is pretty simple to reverse engineer. I have already reversed most of it so this just makes for slightly different way of reading it." As far as offering a route for a USB attack, he said, there no points of the boot chain where a  USB attack could be successful. "In the  iOS 2.x and 3.x days, we beat up iBoot’s USB interface to make jail breaks. So Apple fixed it, and, well, it is a boot loader with a pretty consistent function. So more changes to USB access will never be needed, probably."

Apple has placed a great deal of emphasis on its boot code in security hardening efforts. The Apple bug bounty program offers $200,000 to researchers who discover iOS boot firmware vulnerabilities. So just how damaging this leak will be to iOS users isn't clear at all. In the end, it's more a boon to people like Levin who long for an unblocked view of iOS internals.