Apple to Block SHSH Downgrade With Next iPhone
28 March 2010 by Osornior
The firmwareumbrella published in his blog that he found a new key named APTicket that might be a means for Apple to stop us jailbreakers from restoring to versions of firmwares that are not signed anymore.
This would mean Apple would get complete control over what you restore and when you restore it. While jailbroken devices are able to accept custom firmwares, the new bootroom 3gs and the ipt3g and MC can’t be restored to a custom firmware as of now, so this might become a real situation for the devices to come. This is, of course, until the great team of iPhone hackers, finds a workaround.
Here is an extract from thefirmwareumbrella
“My guess is that in future versions of iTunes, Apple will probably handle the TSS request/response and later this year implement the code to process the response in the actual bootrom of the device. Here’s what I mean:
The newer iTunes versions will send a certificate request in the TSS request by adding a new key to the TSS request.
Their TSS server will create a new certificate with an effective date attached to it. (Making it invalid if used after that date) Until the new bootrom rolls out, iTunes will handle the decrypting of the response blobs using the nifty new signed certificate response ala APTicket.
Once Apple ships new devices with the bootrom capable of validating the new APTicket (or whatever they call it in the future) they can add logic to check the bootrom of the device and conditionally process the response from the TSS server(for old bootroms) or allow the device to process it(for new bootroms).
Looking at the above, it’s a fairly bullet-proof means of stopping local restores. Since the APTicket will be signed and likely shsh’ed I wouldn’t be surprised if they load APTicket or something like unto it BEFORE the LLB is loaded. This way they can not only control what VERSION of the firmware you install, they can also control WHEN you can install it by a means with far longer and sharper teeth.
If they implement the above, the only means of restoring will be via jailbroken device.”
And here is a response to the post from geohot
“Welcome to proper challenge response, guess someone at Apple finally read a book on security. At least it’s not in the bootroms yet.”
Guess we will have to sit tight and wait to see how this next movement of the overlord unfolds.
