iPhone 3GS revision blocks jailbreak

Stephen Withers
Thursday, 15 October 2009 03:11

Your IT - Mobility

A revised bootrom in freshly manufactured iPhone 3GSes eliminates the vulnerability commonly used to jailbreak the popular handset.

Jailbreaking an iPhone (modifying it to allow the use of software not provided by Apple or sold through the App Store) involves a paradox: to enable the iPhone to run unauthorised code, you must first run unauthorised code.

How do you do that? By finding a vulnerability in the built-in code and exploiting it. Normally, we refer to such software as malware, and complain if vendors don't promptly fix the vulnerability.

Apple knew about the vulnerability in the iPhone's bootrom targeted by the '24kpwn' exploit before the iPhone 3GS was shipped, but it took some time for the code to be fixed and revised bootroms to flow through the production process.

(A bootrom is a chip that contains the code telling a device what to do when it is powered up. One of the functions of the iPhone bootrom is to check that the rest of the software in the device is as it should be.)

According to reports (eg, iClarified), Apple is now shipping iPhone 3GS units with a new version of the bootrom, which is identified as iBoot-359.3.2.

It seems that none of the currently popular jailbreak tools (eg Blackra1n and PwnageTool) work on 359.3.2, leaving iPhone hackers to find a new vulnerability in the handset.

'MuscleNerd' (a member of the iPod Dev Team) is being widely credited as the source of the news that the updated bootrom interferes with the current jailbreak process. However, he subsequently pointed out that this does not mean jailbreaking the new models is impossible.

What it does mean is that jailbreaks for such devices require the assistance of a computer (or other device) each time the iPhone is booted, which can happen as the result of the battery running out or a reset happens due to a software bug. These 'tethered' techniques are clearly much less convenient than a permanent jailbreak that survives a reset.

It remains to be seen whether hackers can identify another vulnerability that will allow the creation of a useful jailbreak.