iOS jailbreaking

Since software programs available through APT and or Installer.app (legacy) are not required to adhere to App Store guidelines, many of them are not typical self-contained apps but instead are extensions and customization options for iOS and its features and other apps (commonly called tweaks).[8] Users install these programs for purposes including personalization and customization of the interface using tweaks developed by developers and designers,[8] adding desired features such as access to the root file system and fixing annoyances,[9] and making development work on the device easier by providing access to the file system and command-line tools.[10][11] Many Chinese iOS device owners also jailbreak their phones to install third-party Chinese character input systems because they are easier to use than Apple's.[12]

In some cases, jailbreak features are adopted by Apple and used as inspiration for features that are incorporated into iOS and iPadOS.[13][14]

Jailbreaking also opens the possibility for using software to unofficially unlock carrier-locked iPhones so they can be used with other carriers.[18] Software-based unlocks have been available since September 2007,[19] with each tool applying to a specific iPhone model and baseband version (or multiple models and versions).[20] This includes the iPhone 4S, iPhone 4, iPhone 3GS, and iPhone 3G models. An example of unlocking an iPhone through a Jailbreak utility would be Redsn0w. Through this software, iPhone users will be able to create a custom IPSW and unlock their device. Moreover, during the unlocking process, there are options to install Cydia the iPad baseband.

Cybercriminals may jailbreak an iPhone to install malware or target jailbroken iPhones on which malware can be installed more easily. The Italian cybersecurity company Hacking Team, which sells hacking software to law enforcement agencies, advised police to jailbreak iPhones to allow tracking software to be installed on them.[21][22]

On iOS devices, the installation of consumer software is generally restricted to installation through the App Store. Jailbreaking, therefore, allows the installation of pirated applications.[23] It has been suggested that a major motivation for Apple to prevent jailbreaking is to protect the income of its App Store, including third-party developers and allow the buildup of a sustainable market for third-party software.[24] However, the installation of pirated applications is also possible without jailbreaking, taking advantage of enterprise certificates to facilitate the distribution of modified or pirated releases of popular applications.[25]

Many different types of jailbreaks have been developed over the years, differing in how and when the exploit is applied.

When a jailbroken device is booting, it loads Apple's own boot software initially. The device is then exploited and the kernel is patched every time it is turned on. An untethered jailbreak is a jailbreak that does not require any assistance when it reboots up. The kernel will be patched without the help of a computer or an application.[34] These jailbreaks are uncommon and take a significant amount of reverse engineering to create. For this reason, untethered jailbreaks have become much less popular, and Fugu14[35] is currently the only jailbreak that supports recent iOS versions.

A tethered jailbreak is the opposite of an untethered jailbreak, in the sense that a computer is required to boot the device. Without a computer running the jailbreaking software, the iOS device will not be able to boot at all. While using a tethered jailbreak, the user will still be able to restart/kill the device's SpringBoard process without needing to reboot. Many early jailbreaks were offered initially as tethered jailbreaks.

This type of jailbreak allows a user to reboot their phone normally, but upon doing so, the jailbreak and any modified code will be effectively disabled, as it will have an unpatched kernel. Any functionality independent of the jailbreak will still run as normal, such as making a phone call, texting, or using App Store applications. To be able to have a patched kernel and run modified code again, the device must be booted using a computer.

This type of jailbreak is like a semi-tethered jailbreak in which when the device reboots, it no longer has a patched kernel, but the key difference is that the kernel can be patched without using a computer. The kernel is usually patched using an application installed on the device without patches. This type of jailbreak has become increasingly popular, with most recent jailbreaks classified as semi-untethered.

A few days after the original iPhone became available in July 2007, developers released the first jailbreaking tool for it,[36] and soon a jailbreak-only game app became available.[37] In October 2007, JailbreakMe 1.0 (also called "AppSnapp") allowed people to jailbreak iPhone OS 1.1.1 on both the iPhone and iPod Touch,[38][39] and it included Installer.app as a way to get software for the jailbroken device.

In February 2008, Zibri released ZiPhone, a tool for jailbreaking iPhone OS 1.1.3 and iPhone OS 1.1.4.[40]

The iPhone Dev Team, which is not affiliated with Apple, has released a series of free desktop-based jailbreaking tools. In July 2008 it released a version of PwnageTool to jailbreak the then new iPhone 3G on iPhone OS 2.0 as well as the iPod Touch,[41][42] newly including Cydia as the primary third-party installer for jailbroken software.[43] PwnageTool continues to be updated for untethered jailbreaks of newer iOS versions.[44][45]

In November 2008 the iPhone Dev Team released QuickPwn to jailbreak iPhone OS 2.2 on iPhone and iPod Touch, with options to enable past functionality that Apple had disabled on certain devices.[46]

After Apple released iPhone OS 3.0 in June 2009, the Dev Team published redsn0w as a simple jailbreaking tool for Mac and Windows, and also updated PwnageTool primarily intended for expert users making custom firmware, and only for Mac.[47] It continues to maintain redsn0w for jailbreaking most versions of iOS 4 and iOS 5 on most devices.[48]

George Hotz developed the first iPhone unlock. In 2009, he released a jailbreaking tool for the iPhone 3GS on iPhone OS 3.0 called purplera1n,[49] and blackra1n for iPhone OS version 3.1.2 on the 3rd generation iPod Touch and other devices.[50]

In October 2010, George Hotz released limera1n, a low-level boot ROM exploit that permanently works to jailbreak the iPhone 4 and is used as a part of tools including redsn0w.[51]

Nicholas Allegra (better known as "comex") released a program called Spirit in May 2010.[52] Spirit jailbreaks devices including iPhones running iPhone OS 3.1.2, 3.1.3, and iPad running iPhone OS 3.2.[52] In August 2010, comex released JailbreakMe 2.0, the first web-based tool to jailbreak the iPhone 4 (on iOS 4.0.1).[53][54] In July 2011, he released JailbreakMe 3.0,[55] a web-based tool for jailbreaking all devices on certain versions of iOS 4.3, including the iPad 2 for the first time (on iOS 4.3.3).[56] It used a flaw in PDF file rendering in mobile Safari.[57][58]

Chronic Dev Team initially released Greenpois0n in October 2010, a desktop-based tool for untethered jailbreaking iOS 4.1[59] and later iOS 4.2.1[60] on most devices including the Apple TV,[61] as well as iOS 4.2.6 on CDMA (Verizon) iPhones.[62]

As of December 2011, redsn0w included the "Corona" untether by pod2g for iOS 5.0.1 for iPhone 3GS, iPhone 4, iPad (1st generation), and iPod Touch (3rd and 4th generation).[45] As of June 2012, redsn0w also includes the "Rocky Racoon" untether by pod2g for iOS 5.1.1 on all iPhone, iPad, and iPod Touch models that support iOS 5.1.1.[63]

The iPhone Dev Team, Chronic Dev Team, and pod2g collaborated to release Absinthe in January 2012, a desktop-based tool to jailbreak the iPhone 4S for the first time and the iPad 2 for the second time, on iOS 5.0.1 for both devices and also iOS 5.0 for iPhone 4S.[34][64][65][66] In May 2012 it released Absinthe 2.0, which can jailbreak iOS 5.1.1 untethered on all iPhone, iPad, and iPod Touch models that support iOS 5.1.1, including jailbreaking the third-generation iPad for the first time.[67]

An iOS 6.X untethered jailbreak tool called "evasi0n" was released for Linux, OS X, and Windows on February 4, 2013.[68] Due to the high volume of interest in downloading the jailbreak utility, the site initially gave anticipating users download errors. When Apple upgraded its software to iOS 6.1.3 it permanently patched out the evasi0n jailbreak.[69]

In April 2013, the latest versions of Sn0wbreeze was released, which added the support for tethered jailbreaking on A4 devices (i.e. devices not newer than the iPhone 4, iPad (1st generation), or iPod Touch (4th generation)).

On November 29, 2014, TaiG team released their untethered jailbreak tool called "TaiG" for devices running iOS 8.0–8.1.1. On December 10, 2014, the app was updated to include support for iOS 8.1.2.[70] On July 3, 2015, TaiG 2.3.0 was released, which includes support for iOS 8.0–8.4.[71]

On October 14, 2015, Pangu Team released Pangu9, their untethered jailbreak tool for iOS 9.0 through 9.0.2. On March 11, 2016, Pangu Team updated their tool to support iOS 9.1 for 64-bit devices.[72][73]

On July 17, 2016, Pangu Team released Pangu93, a semi-untethered jailbreak tool for iOS 9.2–9.3.3. It was the first semi-untethered jailbreak and at the same time made within a sideloaded app, and included support only for 64bit devices.

On mid-March 2017, jk9357 (aka @REALKJCMEMBER), part of the KJC (Kim Jong Cracks) hacking team, released the first semi-untethered jailbreak for 32-bit devices on 9.1–9.3.4, known as Home Depot. This jailbreak is based on the open source Trident exploit released on GitHub by Benjamin Randazzo. The exploit makes use of some of the Pegasus vulnerabilities.[74]

On December 21, 2016, a beta semi-untethered jailbreak tool for iOS 10.1 known as yalu+mach_portal was released for select 64-bit iOS devices. The jailbreak made use of Ian Beer's, of Google Project Zero, mach_portal exploit. This version is extremely unstable and was only meant for developers. On January 26, 2017, with help from Marco Grassi, a more stable version for iOS 10.2 was released, eventually supporting all 64-bit iOS devices except for the iPhone 7 and 7 Plus, which is only supported by the older, more unstable version for 10.1.1. This jailbreak made use of Ian Beer's, of Project Zero, extra_recipe exploit. Both jailbreaks are installed through a computer application known as Cydia Impactor, which allows signing of apps not in the App Store. Todesco said that the newer version would be eventually updated to support the iPhone 7 and 7 Plus up to iOS 10.1.1, however, he left the jailbreaking scene on March 28, abandoning both jailbreaks before it was released.

On February 26, 2018, a public version of the Electra jailbreak was released for iOS devices on 11.0–11.1.2.[75] This jailbreak uses a KPPless exploit. As Cydia Substrate had not been updated for iOS 11, Electra uses a Substrate alternative known as Substitute.

On June 6, 2018, Abraham Masri released an update to Houdini, the first semi-jailbreak. The tool has been updated to beta 3 revision 1, adding the compatibility with iOS 11 up to 11.3.1.

On July 6, 2018, developer CoolStar updated the Electra jailbreak for iOS devices on 11.0–11.4.1 (it previously only supported up to 11.1.2).[75] It continued to use a KPPless exploit and Substitute in place of Cydia Substrate.

On February 1, 2019, a proof of concept for a jailbreak Osiris Jailbreak / OsirisJailbreak12 was released compatible with iOS 12.0 to iOS 12.1.2.

On December 9, 2019, A public update to the unc0ver jailbreak was released to add support for iOS 12.4.1. This version of unc0ver used the AppleAVE2Driver exploit,[76] developed by 08Tc3wBB, who submitted/sold the exploit to ZecOps for the Task-For-Pwn 0 Bounty.

On December 29, 2021, A public update to the unc0ver jailbreak was released to add support for IOS 14.6-14.8 for A12-A13 iPhones (XS-11 Pro Max) only, with no iPad support, using an as-yet-unnamed exploit developed by security researcher pattern_f_.

On September 17, 2022, palera1n was released as a developer-oriented jailbreak for checkm8 devices (A8-A11) on iOS 15.0+.[77] On A11 devices, the passcode must be disabled and will not be able to use any SEP functionality such as passcode, Face ID/Touch ID, and Apple Pay until booted into a stock iOS state.[78]

On October 31, 2022, Linus Henze, previous developer of Fugu14, demo’d, and then released, a proof-of-concept jailbreak called Fugu15,[79] capable of exploiting iOS 15 to iOS 15.5 Beta 2 using 4 exploits.[80][81][82][83]

On March 29, 2023, Lars Fröder released a fork called Fugu15 Max,[84] which adds partial tweak support through ElleKit,[85] subsequent updates improved tweak support and the jailbreak’s stability, which is later renamed to Dopamine, Dopamine’s official release date is May 3, 2023.[86]

In 2010, Electronic Frontiers Australia said that it is unclear whether jailbreaking is legal in Australia, and that anti-circumvention laws may apply.[160] These laws had been strengthened by the Copyright Amendment Act 2006.

In November 2012, Canada amended its Copyright Act with new provisions prohibiting tampering with DRM protection, with exceptions including software interoperability.[161] Jailbreaking a device to run alternative software is a form of circumventing digital locks for the purpose of software interoperability.

There had been several efforts from 2008–2011 to amend the Copyright Act (Bill C-60, Bill C-61, and Bill C-32) to prohibit tampering with digital locks, along with initial proposals for C-11 that were more restrictive,[162] but those bills were set aside. In 2011, Michael Geist, a Canadian copyright scholar, cited iPhone jailbreaking as a non-copyright-related activity that overly-broad Copyright Act amendments could prohibit.[163]

India's copyright law permits circumventing DRM for non-copyright-infringing purposes.[164][165] Parliament introduced a bill including this DRM provision in 2010 and passed it in 2012 as Copyright (Amendment) Bill 2012.[166] India is not a signatory to the WIPO Copyright Treaty that requires laws against DRM circumvention, but being listed on the US Special 301 Report "Priority Watch List" applied pressure to develop stricter copyright laws in line with the WIPO treaty.[164][165]

New Zealand's copyright law allows the use of technological protection measure (TPM) circumvention methods as long as the use is for legal, non-copyright-infringing purposes.[167][168] This law was added to the Copyright Act 1994 as part of the Copyright (New Technologies) Amendment Act 2008.

Jailbreaking might be legal in Singapore if done to provide interoperability and not circumvent copyright, but that has not been tested in court.[169]

The law Copyright and Related Rights Regulations 2003 makes circumventing DRM protection measures legal for the purpose of interoperability but not copyright infringement. Jailbreaking may be a form of circumvention covered by that law, but this has not been tested in court.[155][170] Competition laws may also be relevant.[171]

The main law that affects the legality of iOS jailbreaking in the United States is the 1998 Digital Millennium Copyright Act (DMCA), which says "no person shall circumvent a technological measure that effectively controls access to a work protected under" the DMCA, since this may apply to jailbreaking.[172] Every three years, the law allows the public to propose exemptions for legitimate reasons for circumvention, which last three years if approved. In 2010 and 2012, the U.S. Copyright Office approved exemptions that allowed smartphone users to jailbreak their devices legally,[173] and in 2015 the Copyright Office approved an expanded exemption that also covers other all-purpose mobile computing devices, such as tablets.[174] It is still possible Apple may employ technical countermeasures to prevent jailbreaking or prevent jailbroken phones from functioning.[175] It is unclear whether it is legal to traffic in the tools used to make jailbreaking easy.[175]

In 2010, Apple announced that jailbreaking "can violate the warranty".[176]

In 2007, Tim Wu, a professor at Columbia Law School, argued that jailbreaking "Apple's superphone is legal, ethical, and just plain fun."[177] Wu cited an explicit exemption issued by the Library of Congress in 2006 for personal carrier unlocking, which notes that locks "are used by wireless carriers to limit the ability of subscribers to switch to other carriers, a business decision that has nothing whatsoever to do with the interests protected by copyright" and thus do not implicate the DMCA.[178] Wu did not claim that this exemption applies to those who help others unlock a device or "traffic" in software to do so.[177]

In 2010, in response to a request by the Electronic Frontier Foundation, the U.S. Copyright Office explicitly recognized an exemption to the DMCA to permit jailbreaking in order to allow iPhone owners to use their phones with applications that are not available from Apple's store, and to unlock their iPhones for use with unapproved carriers.[179][180] Apple had previously filed comments opposing this exemption and indicated that it had considered jailbreaking to be a violation of copyright (and by implication prosecutable under the DMCA). Apple's request to define copyright law to include jailbreaking as a violation was denied as part of the 2009 DMCA rulemaking. In their ruling, the Library of Congress affirmed on July 26, 2010, that jailbreaking is exempt from DMCA rules with respect to circumventing digital locks. DMCA exemptions must be reviewed and renewed every three years or else they expire.

On October 28, 2012, the US Copyright Office released a new exemption ruling. The jailbreaking of smartphones continued to be legal "where circumvention is accomplished for the sole purpose of enabling interoperability of [lawfully obtained software] applications with computer programs on the telephone handset." However, the U.S. Copyright office refused to extend this exemption to tablets, such as iPads, arguing that the term "tablets" is broad and ill-defined, and an exemption to this class of devices could have unintended side effects.[181][182][183] The Copyright Office also renewed the 2010 exemption for unofficially unlocking phones to use them on unapproved carriers, but restricted this exemption to phones purchased before January 26, 2013.[182] In 2015, these exemptions were extended to include other devices, including tablets.[184]

In addition to the news and software hosting website, BigBoss also distributed many utilities that ran on jailbroken devices. These included SBSettings, BossPrefs, BossPaper, Categories, and Flashlight.[188][189][190]

On October 18, 2008, the site rebranded from Sleepers Repository to TheBigBoss.[191]

On March 8, 2009, Cydia Store launched, allowing users to purchase software products from the repository. Previously, it had only consisted of free software.[192]

In July 2014, the website was hacked, leaking the entire database and collection of packages (including paid products).[193]

In November 2017, other significant early Cydia Store repositories, ModMyi and ZodTTD, shut down, making BigBoss one of the last original repositories standing.[194]

In December 2018, the Cydia Store shut down, meaning that no new packages could be purchased. Packages that have been previously paid for can still be installed, and free packages can still be installed. New repositories have been creating and using their own payment systems.[195]

The first iPhone worm, iKee, appeared in early November 2009, created by a 21-year-old Australian student in the town of Wollongong. He told Australian media that he created the worm to raise awareness of security issues: jailbreaking allows users to install an SSH service, which those users can leave in the default insecure state.[196] In the same month, F-Secure reported on a new malicious worm compromising bank transactions from jailbroken phones in the Netherlands, similarly affecting devices where the owner had installed SSH without changing the default password.[197][198]

In 2010 blogger John Gruber, who is close to Apple, said that users misunderstood some jailbreak exploits and that they were more serious than they appear. He commented that "it's odd how the press is mostly covering this as 'jailbreaking now more convenient' rather than 'remote code exploit now in the wild'", pointing out that the exploit allowed the creator of a malicious website to take control of iPhones accessing it.[199] Restoring a device with iTunes removes a jailbreak.[200][201][202] However, doing so generally updates the device to the latest, and possibly non-jailbreakable, version, due to Apple's use of SHSH blobs. There are many applications that aim to prevent this, by restoring the devices to the same version they are currently running whilst removing the jailbreaks. Examples are, Succession, Semi-Restore and Cydia Eraser.

In 2012, Forbes staff analyzed a UCSB study on 1,407 free programs available from Apple and a third-party source. Of the 1,407 free apps investigated, 825 were downloaded from Apple's App Store using the website App Tracker, and 526 from BigBoss (Cydia's default repository). 21% of official apps tested leaked device ID and 4% leaked location. Unofficial apps leaked 4% and 0.2% respectively. 0.2% of apps from Cydia leaked photos and browsing history, while the App Store leaked none. Unauthorized apps tended to respect privacy better than official ones.[203] Also, a program available in Cydia called PrivaCy allows user to control the upload of usage statistics to remote servers.[203]

In August 2015, the KeyRaider malware was discovered, affecting only jailbroken iPhones.[204]

In recent years, due to the technical complexity and often rarity of legitimate jailbreaking software (especially untethered jailbreaks) there has been an increase in websites offering fake iOS jailbreaks. These websites often ask for payment or make heavy use of advertising, but have no actual jailbreak to offer. Others install a fake, lookalike version of the Cydia package manager.[205] In some cases, users have been asked to download free-to-play apps or fill out surveys to complete a (non-existent) jailbreak.