According to 9to5Mac, a Russian hacker has published a relatively simple method that allows users to obtain in-app purchases from many iOS apps for free.
The method, which doesn’t require a jailbreak, involves installation of two certificates on the user’s iOS device and changing DNS entry in wi-fi settings. Then users can perform purchases of in-app content as usual.
The iPhone Dev-Team has released RedSn0w 0.9.12b2. New version has some bugfixes and additional question about jailbreak mode for A4 devices.
Redsn0w allows owners of A4+earlier devices to install rocky-racoon two different ways:
Redsn0w 0.9.12b2 will ask owners of iPhone 3GS, , iPod Touch 3G, iPod Touch 4G and iPad 1 what jailbreak mode they would like to use.
Starting with version 0.9.12b2, redsn0w will now explicitly ask users with limera1n-able devices whether they want to inject rocky-racoon using the DFU ramdisk method or the backup/restore method (the ramdisk method is better for those with lots of media on their device that would create very large backups, and it’s required for those with unactivated iPhones). If you’ll always want to use limera1n, you can select that in the Preferences pane. It also fixes an iBooks issue on old-bootrom 3GS iPhones, and provides more useful error messages when things go wrong.
RedSn0w 0.9.12b2 supports untethered iOS 5.1.1 jailbreak for all devices:
You can download RedSn0w 0.9.12b2 .
iOS 5.1.1 untethered jailbreak tutorial using Redsn0w is available .
The iPhone Dev-Team has released updates to RedSn0w and PwnageTool that bring support for the iOS 5.1.1 untethered jailbreak.
RedSn0w 0.9.12b1 supports untethered iOS 5.1.1 jailbreak for all devices:
PwnageTool 5.1.1 allows to create custom firmware and preserve modem version for unlock with ultrasn0w or Gevey. PwnageTool 5.1.1 supports all A4 devices:
You can download RedSn0w 0.9.12b1 and PwnageTool 5.1.1 .
iOS 5.1.1 untethered jailbreak tutorial using Redsn0w is available .
Official DevTeam comments:
RedSn0w
redsn0w allows owners of A4+earlier devices to install rocky-racoon two different ways:
- backup/restore method similar to Absinthe and cinject
- its traditional limera1n-based ramdisk install. If you have a lot of media on your A4 device (music, movies, TV shows, etc), then the ramdisk method is preferrred because it avoids any possibility of later problems related to syncing to iCloud (including Photo Stream and Music Match). The ramdisk method is not available for A5 devices or later because limera1n can’t be used. If you’d like to use redsn0w’s ramdisk method, just be sure to put the A4 device in DFU or Recovery mode before starting redsn0w (otherwise it will immediately start to use the backup/restore method).
We’ve also added a new redsn0w feature specifically for those who got in on the SAM unlock: you can now include your SAM tickets as part of your initial ramdisk jailbreak of iPhone4 or earlier, or alternatively you can upload your SAM tickets to any device after its been jailbroken. redsn0w accepts either the individual SAM activation ticket plist file, or the entire zip file created by redsn0w’s “Backup” button. As usual, redsn0w continues to cover all of its previous jailbreaks and untethers (so redsn0w-0.9.12b1 covers everything from 5.1.1 all the way back to 4.1).
PwnageTool
PwnageTool also avoids any possible sync issues, but again it applies only to A4+earlier devices. If you unlock your iPhone with ultrasn0w or a commercial method, you must use PwnageTool to avoid updating your baseband otherwise you’ll lose the unlock. PwnageTool will also jailbreak+untether the AppleTV2,1 5.0_2B206f (unless you customize the IPSW further, you’ll have just basic SSH access to the device).
MuscleNerd from the iPhone Dev-Team has posted some details on the upcoming untethered jailbreak from pod2g.
- All info below is tentative and subject to last minute refinements
- @pod2g’s 5.1.1 jailbreak+untether is working out great. All devices are covered except for AppleTV3,1, which currently has no path for jailbreaking.
- the initial 5.1.1 plan used a kernel exploit from @westbaer which unfortunately precluded use in iPod3,1 and iPhone2,1
- @planetbeing stepped up and provided a kernel exploit that covers both of those. Those two JBers are the bomb!- The 5.1.1 A5 JB is very similar to the A5 5.0.1 JB. @pimskeks has done a tremendous job supporting both 5.0.1 and 5.1.1 in absinthe
- Similar to 5.0.1, there will also be a 5.1.1 CLI “cinject” binary and redsn0w version of the 5.1.1 JB+untether. Absinthe, cinject, and redsn0w will all provide the same JB in different fashions.
- timing is indeterminate. Plans are for this week, but a number of factors can influence that.- For those wishing to donate, we’ve set up a new 5.1.1 paypal URL: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=4U6DQGJ2NRVUN
- Please don’t pirate AppStore apps (seriously, please do not).
A new unlock has been discovered that works for all iPhones and all 5.x firmware versions, all basebands are supported.
The method discovered by Loktar_Sun appears to exploit a logical bug in Apple’s server and can be performed on any jailbroken iOS device. His procedure involves using Sam Bingner’s SAM (Subscriber Artificial Module) package to perform a series of steps that unlocks your phone to use a specific SIM.
It has been confirmed working by iPhone Dev-Team member MuscleNerd who notes an update may be coming to SAM from @sbingner to make the procedure simpler.
We will post detailed step by step unlock instructions soon.
UPDATE: Tutorial is ready! You can find it .
This week Gareth Wright that Facebook’s app for iOS has a security vulnerability through which malicious users can access login credentials saved in a .plist file of the app. With a copy of that .plist file malicious users could automatically log into the affected user’s Facebook account on another device. Reportedly, the vulnerability also exists on Android devices.
Wright describes several different ways in which your login credentials could be obtained by a malicious user, including hidden applications installed on shared PCs, customized apps, or modified speaker dock that could copy your plist.
Facebook, the issue only affects jailbroken or lost devices, as it requires physical access or installation of a custom app on the device. But Wright and pointed out that simply plugging into any device would be sufficient for malicious users to gather these files.
The Next Web has confirmed that Dropbox for iOS is also vulnerable to this issue. Given that two such high-profile apps as Facebook and Dropbox are vulnerable to credential theft, it is likely that other apps are also affected by the issue.
As many reports note, this method of gathering login credentials is not actively utilized in a malicious manner, and users can protect their data for the time being by not plugging their devices into shared computers and charging stations.
Gevey has announced the Gevey Ultra S SIM interposer which unlocks iPhone 4S without the need for dialing 112 or jailbreaking. The makers claim to be using a new exploit that ‘fully unlocks’ the device.
Pre-Order ONLY (Shipping ETA Between March 3-March 7)
GEVEY Ultra S for GSM iPhone 4S
- No Need to Dial International Emergency Number 112
- Untethered Unlock with no Jailbreak Required
- Compatible with all GSM iPhone 4S SIM Cards (Does not work on CDMA iPhone)
- Complete Unlock with all 2G and 3G data services
- No SIM Card Cutting or Physical Modifications
- Works on iOS 5.0, 5.0.1
- Works on Baseband 1.0.11, 1.013, 1.0.14
- Guaranteed Better Reception than Previous
- Decreased Power Consumption
Gevey Ultra S is available for $54.99 .
Take a look at video demonstration:
The iPhone Dev-Team has released RedSn0w 0.9.10b5 which includes another fix for iBooks DRM by planetbeing.
As always, you can simply run the new redns0w over your current jailbreak, just make sure to uncheck Cydia. To fix iBooks and launchctl errors you can also simply install .
You can download the new version of RedSn0w from .
Our step-by-step tutorials for untethered jailbreak using redsn0w 0.9.10:
iPhone Dev Team have just released a new version of RedSn0w 0.9.10b4. It includes a fixes for iBooks and launchctl. As always, you can simply run the new redns0w over your current jailbreak, just make sure to uncheck Cydia. To fix iBooks and launchctl errors you can also simply install .
Update #4: The b4 version of redsn0w incorporates the 5.0.1 fix for iBooks, and also for sporadic problems with launchctl. Thanks to @xvolks for merging the iBooks (sandbox) fix from @comex’s github into the overall corona untether from @pod2g! As usual, you can choose to install the fix either by re-running redsn0w over your existing jailbreak (de-select Cydia if you do that), or by installing the corona package from Cydia (it’s the same set of files no matter which way you choose).
You can download the new version of RedSn0w from .
Pod2g has recently announced that Planetbeing, MuscleNerd, and P0sixninja have joined his effort to release an iOS 5.0.1 untethered jailbreak for the iPhone 4S and iPad 2.
@planetbeing, the legendary hacker behind iPhone Linux and lot of jailbreaks has joined the A5 research! The famous @MuscleNerd, the leader of the iPhone Dev Team, who did a lot of tests for Corona and whom integrated it and made it simple in redsn0w is willing to help also. And last, but not least @p0sixninja, the leader of the Chronic Dev Team, and my partner for years on iPhone security research has started to code and fuzz the Apple sandbox.
That means that we now have a dream team to create a public release of the A5 jailbreak.
Several day ago pod2g posted information why the A5 jailbreak had not been released yet. The key reason being that the exploit used for A4 devices (called limera1n) doesn’t work on A5 devices. The untethered iPhone 4S and iPad 2 jailbreak that we have seen on videos and photos was created relying on having a developer account.
We are sure that planetbeing, MuscleNerd, p0sixninja and pod2g is just a great team. Hopefully they will find necessary exploit and implement it fast, because Apple might release 5.0.2 or 5.1 and fix untathered.