Earlier this week, source code for iBoot, a core component of the iPhone's operating system,
leaked on GitHub. The code was old, for a version of iOS 9, and it was quickly
pulled from GitHub after Apple issued a DMCA takedown notice, but it left many wondering how such sensitive code ended up publicly available.
To answer that question,
Motherboard got in touch with unnamed sources who were involved in the leak and investigated screenshots, text messages, and more, to determine just how it happened.
As it turns out, the code originally came from a low-level Apple employee who took the code from Apple in 2016 to share with friends in the jailbreaking community. This employee wasn't unhappy with Apple and didn't steal the code with malicious intent, but instead was encouraged by friends to obtain the code to benefit the jailbreaking community.The original group of five people who were provided with access to the code didn't intend to share it, but it somehow got out. From one of the original people involved:The code began circulating more widely in 2017 and picked up in popularity late in the year before ending up on GitHub this week. Many in the jailbreaking and iPhone research communities attempted to stop sharing, but the major public leak couldn't be avoided.
According to the unnamed people who spoke to
Motherboard, what leaked wasn't the "full leak." "It's not the original leak-it's a copy," said one source.
Following the leak, Apple confirmed the authenticity of the code in a statement to
MacRumors and pointed out that it's for a three-year-old operating system that's been replaced by iOS 11 and is in use only on a small number of devices.The iBoot code leak should not be of concern to the average user because Apple has many layers of protection in place, like the Secure Enclave, and does not rely on source code secrecy alone to keep its users safe. The leak could, however, make it easier for people to locate vulnerabilities to create new jailbreaks.
Article Link:
iPhone Source Code Was Leaked by Low-Level Apple Employee