{"id":20475,"date":"2018-02-09T14:56:43","date_gmt":"2018-02-09T19:56:43","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=20475"},"modified":"2018-02-13T11:46:52","modified_gmt":"2018-02-13T16:46:52","slug":"ios-9-source-code-leak","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2018\/02\/09\/ios-9-source-code-leak\/","title":{"rendered":"iOS 9 Source Code Leak"},"content":{"rendered":"

Lorenzo Franceschi-Bicchierai<\/a> (Hacker News<\/a>, MacRumors<\/a>):<\/p>\n

\n

The GitHub code is labeled “iBoot,” which is the part of iOS that is responsible for ensuring a trusted boot of the operating system. In other words, it’s the program that loads iOS, the very first process that runs when you turn on your iPhone. It loads and verifies the kernel is properly signed by Apple and then executes it—it’s like the iPhone’s BIOS.<\/p>\n

The code says it’s for iOS 9, an older version of the operating system, but portions of it are likely to still be used in iOS 11.<\/p>\n

[…]<\/p>\n

“This is the biggest leak in history,” Jonathan Levin, the author of a series of books on iOS and Mac OSX internals, told me in an online chat, referring to Apple’s history. “It’s a huge deal.”<\/p>\n<\/blockquote>\n\n

Via Jake Williams<\/a>:<\/p>\n

Remember that debate about the FBI adding backdoors to the iPhone and “don’t worry, it will stay secret?” None of us believed that, ever. But now I’d say we have evidence that even Apple can’t keep backdoor code a secret…<\/p><\/blockquote>\n\n

Sean Gallagher<\/a>:<\/p>\n

\n

The DMCA notice required Apple to verify that the code was their property—consequently confirming that the code was genuine. While GitHub removed the code, it was up for several hours and is now circulating elsewhere on the Internet.<\/p>\n<\/blockquote>\n\n

Steve Troughton-Smith<\/a>:<\/p>\n

The scary part about the iBoot source code leak isn’t that iBoot code leaked, it’s that somebody (from Apple) passed around Apple source code. And if this happens in public, what would you imagine is being sent in private to the most malicious of bad actors or hostile powers?<\/p><\/blockquote>\n\n

Sean<\/a>:<\/p>\n

\n

I happen to have a copy of the System 7 source code that I acquired so long ago that I can’t even remember where it came from. So Apple employees passing around source code is nothing new.<\/p>\n<\/blockquote>\n\n

Previously: FBI Asks Apple for Secure Golden Key<\/a>.<\/p>\n\n

Update (2018-02-09): Lorenzo Franceschi-Bicchierai<\/a>:<\/p>\n

\n

A low-level Apple employee with friends in the jailbreaking community took code from Apple while working at the company’s Cupertino headquarters in 2016, according to two people who originally received the code from the employee. Motherboard has corroborated these accounts with text messages and screenshots from the time of the original leak and has also spoken to a third source familiar with the story.<\/p>\n

Motherboard has granted these sources anonymity given the likelihood of Apple going after them for obtaining and distributing proprietary, copyrighted software. The original Apple employee did not respond to our request for comment and said through his friend that he did not currently want to talk about it because he signed a non-disclosure agreement with Apple.<\/p>\n

According to these sources, the person who stole the code didn’t have an axe to grind with Apple. Instead, while working at Apple, they were encouraged to use their access to help their friends in the jailbreaking community with their security research by leaking them internal Apple code. And they did.<\/p>\n<\/blockquote>\n\n

Update (2018-02-13): See also: MacRumors<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

Lorenzo Franceschi-Bicchierai (Hacker News, MacRumors): The GitHub code is labeled “iBoot,” which is the part of iOS that is responsible for ensuring a trusted boot of the operating system. In other words, it’s the program that loads iOS, the very first process that runs when you turn on your iPhone. It loads and verifies the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"","apple_news_api_id":"","apple_news_api_modified_at":"","apple_news_api_revision":"","apple_news_api_share_url":"","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[],"tags":[524,31,1137,688],"class_list":["post-20475","post","type-post","status-publish","format-standard","hentry","tag-github","tag-ios","tag-ios-9","tag-jailbreak"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/20475","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=20475"}],"version-history":[{"count":3,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/20475\/revisions"}],"predecessor-version":[{"id":20492,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/20475\/revisions\/20492"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=20475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=20475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=20475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}