Jailbreak iPhone, iPod Touch, iPad

A new unlock has been discovered that works for all iPhones and all 5.x firmware versions, all basebands are supported.

The method discovered by Loktar_Sun appears to exploit a logical bug in Apple’s server and can be performed on any jailbroken iOS device. His procedure involves using Sam Bingner’s SAM (Subscriber Artificial Module) package to perform a series of steps that unlocks your phone to use a specific SIM.

It has been confirmed working by iPhone Dev-Team member MuscleNerd who notes an update may be coming to SAM from @sbingner to make the procedure simpler.

We will post detailed step by step unlock instructions soon.

UPDATE: Tutorial is ready! You can find it here.

This week Gareth Wright reported that Facebook’s app for iOS has a security vulnerability through which malicious users can access login credentials saved in a .plist file of the app. With a copy of that .plist file malicious users could automatically log into the affected user’s Facebook account on another device. Reportedly, the vulnerability also exists on Android devices.

Wright describes several different ways in which your login credentials could be obtained by a malicious user, including hidden applications installed on shared PCs, customized apps, or modified speaker dock that could copy your plist.

According to Facebook, the issue only affects jailbroken or lost devices, as it requires physical access or installation of a custom app on the device. But Wright and The Next Web pointed out that simply plugging into any device would be sufficient for malicious users to gather these files.

The Next Web has confirmed that Dropbox for iOS is also vulnerable to this issue. Given that two such high-profile apps as Facebook and Dropbox are vulnerable to credential theft, it is likely that other apps are also affected by the issue.

As many reports note, this method of gathering login credentials is not actively utilized in a malicious manner, and users can protect their data for the time being by not plugging their devices into shared computers and charging stations.

Gevey has announced the Gevey Ultra S SIM interposer which unlocks iPhone 4S without the need for dialing 112 or jailbreaking. The makers claim to be using a new exploit that ‘fully unlocks’ the device.

Pre-Order ONLY (Shipping ETA Between March 3-March 7)

GEVEY Ultra S for GSM iPhone 4S

• No Need to Dial International Emergency Number 112
• Untethered Unlock with no Jailbreak Required
• Compatible with all GSM iPhone 4S SIM Cards (Does not work on CDMA iPhone)
• Complete Unlock with all 2G and 3G data services
• No SIM Card Cutting or Physical Modifications
• Works on iOS 5.0, 5.0.1
• Works on Baseband 1.0.11, 1.013, 1.0.14
• Guaranteed Better Reception than Previous
• Decreased Power Consumption

Gevey Ultra S is available for $54.99 here.

Take a look at video demonstration:

The iPhone Dev-Team has released RedSn0w 0.9.10b5 which includes another fix for iBooks DRM by planetbeing.

As always, you can simply run the new redns0w over your current jailbreak, just make sure to uncheck Cydia. To fix iBooks and launchctl errors you can also simply install new version of Corona from Cydia.

You can download the new version of RedSn0w from here.

Our step-by-step tutorials for untethered jailbreak using redsn0w 0.9.10:

• iPhone 4
• iPhone 3GS
• iPod Touch 4G
• iPod Touch 3G
• iPad 1

Read the rest of this entry »

iPhone Dev Team have just released a new version of RedSn0w 0.9.10b4. It includes a fixes for iBooks and launchctl. As always, you can simply run the new redns0w over your current jailbreak, just make sure to uncheck Cydia. To fix iBooks and launchctl errors you can also simply install new version of Corona from Cydia.

Update #4: The b4 version of redsn0w incorporates the 5.0.1 fix for iBooks, and also for sporadic problems with launchctl. Thanks to @xvolks for merging the iBooks (sandbox) fix from @comex’s github into the overall corona untether from @pod2g! As usual, you can choose to install the fix either by re-running redsn0w over your existing jailbreak (de-select Cydia if you do that), or by installing the corona package from Cydia (it’s the same set of files no matter which way you choose).

You can download the new version of RedSn0w from here.

Pod2g has recently announced that Planetbeing, MuscleNerd, and P0sixninja have joined his effort to release an iOS 5.0.1 untethered jailbreak for the iPhone 4S and iPad 2.

@planetbeing, the legendary hacker behind iPhone Linux and lot of jailbreaks has joined the A5 research! The famous @MuscleNerd, the leader of the iPhone Dev Team, who did a lot of tests for Corona and whom integrated it and made it simple in redsn0w is willing to help also. And last, but not least @p0sixninja, the leader of the Chronic Dev Team, and my partner for years on iPhone security research has started to code and fuzz the Apple sandbox.

That means that we now have a dream team to create a public release of the A5 jailbreak.

Several day ago pod2g posted information why the A5 jailbreak had not been released yet. The key reason being that the exploit used for A4 devices (called limera1n) doesn’t work on A5 devices. The untethered iPhone 4S and iPad 2 jailbreak that we have seen on videos and photos was created relying on having a developer account.

We are sure that planetbeing, MuscleNerd, p0sixninja and pod2g is just a great team. Hopefully they will find necessary exploit and implement it fast, because Apple might release 5.0.2 or 5.1 and fix untathered.

iPhone Dev-Team released RedSn0w 0.9.9b9 with full iOS 5.0.1 support (no need to point to iOS 5.0 any more). New version also features support for SHSH and APTickets:

• native support for 5.0.1 (no need to point redsn0w at 5.0 IPSW or use command-line args).  Support automatically extends to all of redsn0w’s various functions: “Jailbreak”, “Just boot”, “Fetch blobs”, “Stitch blobs”, “Recovery Fix”
• iBooks fixed in 5.0 and 5.0.1.  This is a targeted fix that doesn’t remove entire sandbox mechanism.  5.x users already using redsn0w “Just Boot” can just use the new version without redoing entire jailbreak again
• 3GS old-bootrom owners can now create custom IPSWs without blobs
• ultrasn0w compatability update (i.e. same baseband requirements) for 5.0.1 will be available on Cydia Monday
• support for newer 8GB iPhone4 (which until now had problems with “Fetch blobs”).  Thanks to @JKjeepnJeff for loaning us one of these newer i4 units for testing!
• allows Windows users (not just OS X users) to use the “Custom” button to create IPSWs without baseband updates.  (Update: please wait for 0.9.9b9b for this!)
• accommodates APTickets in 5.x (until next Apple countermove).  APTickets are crypto-verified before submitting to Cydia, just like the main blobs.  Cydia server support for sending back the APTickets is upcoming.  For now, use stitched IPSWs for 5.x.  Due to APTickets, stitched 5.x IPSWs now require user to start in “Pwned DFU” mode
• Support added for stitching 4.x blobs to iPad2-GSM IPSWs.  Similar to @notcom’s TinyCFW but doesn’t require lots of RAM or a TSS-assisted restore. Won’t work for iPad2 5.x blobs (or iPhone4S at all) until a bootrom-level exploit is out
• top line now shows whether (and where) a redsn0w update is available, or if the version being run is the latest.  Uses DNS TXT record to alleviate any concerns about snooping
• no 5.1 beta support at this time (major apps like Cydia are not yet compatible)
• @pod2g has been doing a great job porting his 5.x untether…check his blog for updates!
• Owners of newer 3GS iPhones must not flash the iPad baseband.  The iPad baseband will not work on 3GS iPhones built later than 2011 week 35.  You have a week 35 or later device if your serial # starts with xx135.

Update #17b: Version 0.9.9b9b enables the “Custom” button for Windows users, and make the 3GS week 35 warning a more explicit part of the process.

You can download RedSn0w 0.9.9b9b here.

UPDATE: redsn0w updated to redsn0w 0.9.9b9d.

Pod2g has recently announced that he has successfully performed an untethered jailbreak on an iPhone 4 running iOS 5.0.1.

Got an untethered iPhone 4 running iOS 5.0.1. Feel free to update.

Of course, if you want to SIM unlock, don’t update using Apple’s original FW nor update OTA.

This means jailbreakers can update to iOS 5.0.1. Previously it was recommended to stay on iOS 5. Unlockers as usual should stay away from Apple’s firmwares and from iOS 5.0.1.

We strongly recommend that everyone use TinyUmbrella to save their iOS 5.0.1 SHSH Blobs.

Pod2g writes in his blog, that next devices he will try to untehter jailbreak are iPod 3G, iPod 4G and iPad 1.

Semi-tethered jailbreak is already available for some devices for both iOS 5 and iOS 5.0.1. But we all want untethered jailbreak and we want jailbreak for iPad 2 and iPhone 4S. So why not help hackers to find new exploits and vulnerabilities?

The Chronic Dev-Team has a released a tool to collect crash reports from iOS devices in order to find vulnerabilities that could lead to an untethered jailbreak.

The idea is very simple. When your iPhone, iPad or iPod Touch crashes it sends data to Apple (you can turn it this off though). Apple uses these reports to update iOS in the future. By the way, it also uses them to fix exploits found by jailbreakers. P0sixninja says that Apple closed several exploits they have found in IOS 5 beta before the final version of the software was released.

In order to find more vulnerabilities as fast as possible, the team has developed a tool which will copy the crash reports from your device and analyze them to locate potential exploits. The tool will also remove the crash reports from your device and modify your iTunes installation to prevent uploading of that diagnostic information to Apple.

Read the rest of this entry »

Vooma announced a new case for iPhone that includes a backup battery and a slot for SIM-card. The case can work with the app on jailbroken iPhone that emulates the native phone app to make calls via the external SIM card.

John Biggs from TechCrunch tried a pre-release case and noted that all the main functionality remains the same in the Vooma app, but its look and feel is somewhat different. For example, its dialer is a bitmapped copy of the native dialer screen and number and letters look slightly warped.

There are no much details, however it appears that the case works with mini-SIM cards, instead of micro-SIM cards used in the iPhone 4S and iPhone 4. In addition, external SIM card can be used only for voice calls and data is likely to go through the SIM installed in the iPhone. Since the external SIM card works with its own app the iPhone’s SIM card can still be used for making voice calls even when the case is installed.

This case would be helpful for international travelers wanting to use a prepaid SIM from a local mobile carrier, without need to unlock their subsidized smartphone. To unlock an iPhone is usually more difficult than to simply jailbreak it. Vooma’s homopage offers a sign-up form to receive more information on its Peel PG920 case, but the company has yet provided no details on its availability or pricing.