Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

[MacRumors]

Apple in iOS 12.4 mistakenly unpatched a vulnerability that was fixed in the iOS 12.3 update, leading to a new jailbreak available for iOS 12.4 devices, reports Motherboard.

Hackers discovered the vulnerability over the weekend and Pwn20wnd created a publicly available, free jailbreak that works on devices running the latest version of iOS or any version of iOS below iOS 12.3.

Most jailbreak code is kept private to keep Apple from patching it, so this is the first time that a public jailbreak has been available in a while. It was apparently discovered when a user tested an older jailbreak on iOS 12.4 and found the patch had been reverted.

Security researcher Jonathan Levin told Motherboard that the accidental vulnerability also once again makes iPhone users vulnerable to a "100+ day exploit," referring to how long the bug has been around.

Ned Williamson from Google Project Zero said that the bug could be exploited to install spyware on a target iPhone.

The researcher told Motherboard that "somebody could make a perfect spyware" taking advantage of Apple's mistake. For example, he said, a malicious app could include an exploit for this bug that allows it to escape the usual iOS sandbox--a mechanism that prevents apps from reaching data of other apps or the system--and steal user data.

Another scenario is a hacker including the exploit in a malicious webpage, and pairing it with a browser exploit, according to the researcher.

A third security researcher, Stefan Esser said that people should be careful what apps they download from the App Store right now. "Any such app could have a copy of the jailbreak in it," he wrote on Twitter.

Multiple users have confirmed that the jailbreak works and that their devices have been jailbroken using the new software. Apple has not commented on how or why the vulnerability was unpatched, but the company will likely have a fix available soon.

Article Link: Apple Accidentally Unpatches Vulnerability, Leading to New iOS 12.4 Jailbreak

 

[ElectricPotato]

"Unpatched" - There's a new one for the lexicon.

 

[Unity451]

I really wish that I had the surplus of time that hackers always seem to have.

 

[jsmith189]

Honest question... do people still really jailbreak like that? Like, how big is the jailbreak community now?

 

[SkippyThorson]

#Whoops

 

[BarredOwl]

I wish Apple was on its game, but alas, no. It's a company spread too thin, governed by greedy hand-wringers.

 

[dannyyankou]

That's cool and everything, but Apple pretty much added every feature I would've wanted for a jailbreak like 5 years ago.

I guess access to the file system is a big reason. Being able to manage downloads and torrents easier (no, not for pirating )

 

[JPack]

This is pretty ridiculous on Apple's part. I understand Apple develops parallel versions of iOS (12.3, 12.4, etc.) concurrently to reduce development time, but having one team not communicate with the other seems silly.

 

[nwcs]

I really wish that I had the surplus of time that hackers always seem to have.

It’s like squirrels and bird feeders...

 

[Apple Knowledge Navigator]

Cue trumpet: 'Wahh-Wahhh-Wahhhhhh...'

 

[mannyvel]

I'm surprised this regression happened. This points to a breakdown in product management discipline, which in general is a bad sign.

 

[AppleFan91]

I wish Apple was on its game, but alas, no. It's a company spread too thin, governed by greedy hand-wringers.

Yes yes, and Apple is doomed and Steve is rolling in his grave like a gas station hotdog

 

[ralpa]

Havent tried it for years! I am here baby!

 

[xXRainKingXx]

Jailbreaking use to be essential for me but these days I just can't think of any good reasons to do it.

 

[WannaGoMac]

Honest question... do people still really jailbreak like that? Like, how big is the jailbreak community now?

Cant figure out why anyone would need a jailbreak anymore...

 

[tribeaumes]

I don’t understand why people still jailbreak. Like, what else do you want?! So needy.

 

[realtuner]

This is pretty ridiculous on Apple's part. I understand Apple develops parallel versions of iOS (12.3, 12.4, etc.) concurrently to reduce development time, but having one team not communicate with the other seems silly.

Source for your claim this is a result of someone not communicating with another.

 

[scrapesleon]

Cough when does apple do anything *accidentally*

 

[Solver]

This opportunity doesn’t appear very often.
Updated my iPhone 6 Plus and iPod touch 6 to iOS 12.4, then jailbroke them both.
These were never getting iOS 13.

I predict iOS 12.4.1 shortly.

 

[Baymowe335]

This is pretty ridiculous on Apple's part. I understand Apple develops parallel versions of iOS (12.3, 12.4, etc.) concurrently to reduce development time, but having one team not communicate with the other seems silly.

This doesn’t mean the teams don’t communicate or are even different teams.

Stop oversimplifying. You don’t know.

 

[KGBguy]

Mu ha ha ha It's a great day for many jailbreakers, good for them.

 

[redheeler]

I don’t understand why people still jailbreak. Like, what else do you want?! So needy.

It has been a few years since I last jailbroke, but there are still reasons someone might want to. Access to the filesystem, themes and skins, etc.

 

[Killbynumbers]

There was a time that I used to jailbreak every iPhone but the thrill left many years ago.

I still have two iPhone SEs jailbroken on iOS 11 and I haven't used them in over a year. I tried selling them as jailbreakable and got no interest in them. I have older iPhones i could still jailbreak now but I won't bother.

 

[AZMecha]

Cant figure out why anyone would need a jailbreak anymore...

Well as for widgets it is not needed any longer... I do miss the following

1:Bigafy allowed for adding more icons row and changing icon sizes.
2:Music downloader over SSH
3:Overall Themes There was a great batman one which was dark mode back on iPhone 4. awe memories...

 

[I7guy]

Apple get your stuff together. Jail breaking means exploits in the while.

As an aside, it took a while for this news to come out.