On Apple devices running iOS and iOS-based [lower-alpha 1] operating systems, jailbreaking is the use of a privilege escalation exploit to remove software restrictions imposed by the manufacturer. Typically it is done through a series of kernel patches. A jailbroken device typically permits root access within the operating system and provides the right to install software unavailable through the App Store. Different devices and versions are exploited with a variety of tools. Apple views jailbreaking as a violation of the end-user license agreement and strongly cautions device owners not to try to achieve root access through the exploitation of vulnerabilities. [1]
While sometimes compared to rooting an Android device, jailbreaking bypasses several types of Apple prohibitions for the end-user. Since it includes modifying the operating system (enforced by a "locked bootloader"), installing non-officially approved (not available on the App Store) applications via sideloading, and granting the user elevated administration-level privileges (rooting), the concepts of iOS jailbreaking are therefore technically different from Android device rooting.
Expanding the feature set that Apple and its App Store have restricted is one of the motivations for jailbreaking. [2] Apple checks apps for compliance with its iOS Developer Program License Agreement [3] before accepting them for distribution in the App Store. However, the reasons for Apple to ban apps are not limited to safety and security and may be regarded as arbitrary and capricious. [4] In one case, Apple mistakenly banned an app by a Pulitzer-Winning cartoonist because it violated its developer license agreement, which specifically bans apps that "contain content that ridicules public figures." [5] To access banned apps, [6] users rely on jailbreaking to circumvent Apple's censorship of content and features. Jailbreaking permits the downloading of programs not approved by Apple, [7] such as user interface customization and tweaks.
Since software programs available through APT and or Installer.app (legacy) are not required to adhere to App Store guidelines, many of them are not typical self-contained apps but instead are extensions and customization options for iOS and its features and other apps (commonly called tweaks). [8] Users install these programs for purposes including personalization and customization of the interface using tweaks developed by developers and designers, [8] adding desired features such as access to the root file system and fixing annoyances, [9] and making development work on the device easier by providing access to the file system and command-line tools. [10] [11] Many Chinese iOS device owners also jailbreak their phones to install third-party Chinese character input systems because they are easier to use than Apple's. [12]
In some cases, jailbreak features are adopted by Apple and used as inspiration for features that are incorporated into iOS and iPadOS. [13] [14]
| Adopted Feature | Jailbreak Tweak | |||
|---|---|---|---|---|
| iOS Version | Description | Title | Developer | Originally released for |
| 5.0 | Emoji support | Vmoji | Vintendo/ManChild Technologies | iOS 4 |
| Keyboard shortcuts | Xpandr | Nicholas Haunold | ||
| Delete individual calls [15] | Call Delete | IArrays | ||
| 7.0 | Control Center | SBSettings | BigBoss | iPhone OS 2 |
| NCSettings | JamieD360 | iOS 5 | ||
| Translucent Notification Center | BlurredNCBackground | Phillippe | ||
| 8.0 | Interactive Notifications | LockInfo | David Ashman | iOS 4 |
| biteSMS | biteSMS Team | iOS 5 | ||
| Third-Party Keyboards | Fleksy Enabler | Sea Comet | iOS 6 | |
| Predictive Text | PredictiveKeyboard | Matthias Sauppe | ||
| 9.0 | Cursor Control | SwipeSelection | Kyle Howells | iOS 4 |
| Lowercase Keys in Keyboard | ShowCase | Lance Fetters | ||
| 10.0 | Drawing on Messages | Graffiti | IanP | iOS 5 |
| Floating Notification Center | Floater | Skylerk99 | iOS 8 | |
| Bubble Notifications | WatchNotifications | Thomas Finch | ||
| Clear All Notifications | 3D Touch to Clear Notifications | MohammadAG | ||
| OneTapClear | Rave | |||
| Stickers in Messages | StickerMe | Alexander Laurus | ||
| Separate Control Center Pages | Auxo | A3Tweaks | iOS 9 | |
| 11.0 | Cellular Data Control | SBSettings | BigBoss | iPhone OS 2 |
| CCSettings | plipala | iOS 8 | ||
| Customizable Control Center | CChide/CCSettings | plipala | ||
| Onizuka | Maximehip | |||
| Colored Controls | Cream | CP Digital Darkroom | ||
| One-Handed Keyboard (iPhone) | OneHandWizard | TheAfricanNerd, sharedRoutine | ||
| Low Power Mode in Control Center | CCLowPower | Cole Cabral | iOS 10 | |
| Notification design tweaks | CleanNotification10 | Ayden Panhuyzen | ||
| 13.0 [16] | Dark Mode | Eclipse | Guillermo Morán | iOS 7 |
| Noctis | LaughingQuoll | |||
| Download manager in Safari | Safari Plus | BigBoss | iOS 8 | |
| Redesigned volume HUD | Melior | SparkDev | iOS 7 | |
| Ultrasound | Ayden Panhuyzen | iOS 11 | ||
| Wi-Fi/Bluetooth settings in Control Center | WeatherVane | ATWiiks | ||
| Unlimited app download limit on Mobile Data | Appstore Unrestrict | iJulioverne | ||
| Third-party Controller Support | nControl | Kevin Bradley | iOS 12 | |
| 14.0 | Hide apps from Home screen | Poof | BigBoss | iOS 5, [17] possibly older |
| Compact Call Interface | CallBar | Elias Limneos | iOS 7 | |
| Scorpion | Esquilli | iOS 13 | ||
| App Library | Vesta | SparkDev | ||
| Changing CarPlay background | Canvas | Leftyfl1p | ||
| Picture in Picture on iPhone | Titan | TheSaltaCracka | ||
| Home Screen Widgets | HSWidgets | dgh0st | ||
| Smaller Siri | SmallSiri | Muirey03 | ||
| 15.0 | Separation Alerts | Proximitus | LaughingQuoll | iOS 11 |
| Low Power Mode (iPad) | LPMPad | iCraze | iOS 13 | |
| Focus | PureFocus | Dave Van Wijk | ||
| Notification Priority | Contacy | XCXiao | ||
| Redesigned Notifications | Quart | LaughingQuoll | ||
| Velvet | NoisyFlake | |||
| HiMyNameIsUbik | ||||
| 16.0 | Taptic Keyboard | TapticKeys | SparkDev | iOS 10 |
| Redesigned Now Playing Interface | Colorflow | David Goldman | iOS 7 | |
| Chromaflow | Ryan Nair | iOS 14 | ||
| Enhanced Lock Screen customization | Complications | Ben Giannis | iOS 12 | |
| 17.0 [18] | Camera App Composition Features | CameraTweak | Samball | iOS 6 |
| Crossfade in the Music App | Crossfade | H6nry | ||
| Improved Auto-correct | ManualCorrect Pro | Aaron Lindsay (aerialx) | iOS 7 | |
| Live Voicemail | Super Voicemail | hAcx | iOS 8 | |
| Informative App Store Downloads | App Percent | pxcex | iOS 10 | |
| Change Haptic Menu Speed | Better3DMenus | dpkg_ | iOS 11 | |
| Safari Private Browsing Privacy | BioProtect XS | Elias Limneos | iOS 12 | |
| Additional AirPods gestures | Siliqua Pro | LaughingQuoll | ||
| Using Non-System Apps | EvilScheme | Lorenzo | iOS 13 | |
| Interactive Widgets | PowerWidget | Ginsu | iOS 14 | |
| Additional CarPlay Wallpapers | Airaw | Dcsyhi | ||
| Contact Posters | Phoenix | SouthernGirlWhoCode of titand3v | ||
| Verification code auto-deleting | NoMoreShortCodes | Arcas | ||
| Notes App Formatting | Textyle 3 | Ryan Nair | iOS 15 | |
| StandBy Mode | Photon | cemck | iOS 13.0 | |
| Change Lock Screen Time Weight | SimpleTime | p2kdev | iOS 12.0 | |
Jailbreaking also opens the possibility for using software to unofficially unlock carrier-locked iPhones so they can be used with other carriers. [19] Software-based unlocks have been available since September 2007, [20] with each tool applying to a specific iPhone model and baseband version (or multiple models and versions). [21] This includes the iPhone 4S, iPhone 4, iPhone 3GS, and iPhone 3G models. An example of unlocking an iPhone through a Jailbreak utility would be Redsn0w. Through this software, iPhone users will be able to create a custom IPSW and unlock their device. Moreover, during the unlocking process, there are options to install Cydia the iPad baseband.
Cybercriminals may jailbreak an iPhone to install malware or target jailbroken iPhones on which malware can be installed more easily. The Italian cybersecurity company Hacking Team, which sells hacking software to law enforcement agencies, advised police to jailbreak iPhones to allow tracking software to be installed on them. [22] [23]
On iOS devices, the installation of consumer software is generally restricted to installation through the App Store. Jailbreaking, therefore, allows the installation of pirated applications. [24] It has been suggested that a major motivation for Apple to prevent jailbreaking is to protect the income of its App Store, including third-party developers and allow the buildup of a sustainable market for third-party software. [25] However, the installation of pirated applications is also possible without jailbreaking, taking advantage of enterprise certificates to facilitate the distribution of modified or pirated releases of popular applications. [26]
A package manager or package-management system is a collection of software tools that automates the process of installing, upgrading, configuring, and removing computer programs. For jailbreaks, this is essential for the installation of third-party content. There are a few package managers specifically for jailbroken iOS devices, of which the most popular are Cydia, Sileo, Zebra and Installer 5.
Once a device is jailbroken, the built-in security is compromised due to the vast amount of kernel patches that go into building the tool. Security structures like Apple Mobile File Integrity, Sandbox, Read-Only Root File system, and trusted apps get disabled or otherwise tampered with, to achieve the goals of the jailbreaking tool. This, in turn, creates potential security issues for the user of a jailbroken device.
Users of a jailbroken device are also often forced to stay on an inferior iOS version that is no longer supported by Apple because newer versions usually cannot be jailbroken right away. This has the potential to introduce security issues because for these older versions there are known security vulnerabilities, exploits, and exploit proof of concepts published.
In March 2021, jailbreak developer GeoSn0w [27] released a tweak called iSecureOS which can alert the users of security issues found on their devices. The application works akin to antivirus software, in that it scans the files on the user's device and checks them against a database of known malware or unsafe repos.
In June 2021, ESET Research confirmed that malware did exist on one of the piracy repositories in the jailbreak community. The malware actively targeted iSecureOS to try to bypass the detection, [28] but updates to the security app were quickly released and have mitigated the malware.
Jailbreaking of iOS devices has sometimes been compared to "rooting" of Android devices. Although both concepts involve privilege escalation, they do differ in scope.
Where Android rooting and jailbreaking are similar is that both are used to grant the owner of the device superuser system-level privileges, which may be transferred to one or more apps. However, unlike iOS phones and tablets, nearly all Android devices already offer an option to allow the user to sideload 3rd-party apps onto the device without having to install from an official source such as the Google Play store. [29] Many Android devices also provide owners the capability to modify or even replace the full operating system after unlocking the bootloader, although doing this requires a factory reset. [30] [31] [32]
In contrast, iOS devices are engineered with restrictions including a "locked bootloader" which can not be unlocked by the owner to modify the operating system without violating Apple's end-user license agreement. And on iOS, until 2015, while corporations could install private applications onto corporate phones, sideloading unsanctioned, 3rd-party apps onto iOS devices from sources other than the App Store was prohibited for most individual users without a purchased developer membership. [33] After 2015, the ability to install 3rd-party apps became free for all users; however, doing so requires a basic understanding of Xcode and compiling iOS apps.
Jailbreaking an iOS device to defeat all these security restrictions presents a significant technical challenge. [34] Similar to Android, alternative iOS app stores utilizing enterprise certificates are available, offering modified or pirated releases of popular applications and video games, some of which were either previously released through Cydia or are unavailable on the App Store due to these apps not complying with Apple developer guidelines.
 |
Many different types of jailbreaks have been developed over the years, differing in how and when the exploit is applied.
When a jailbroken device is booting, it loads Apple's own boot software initially. The device is then exploited and the kernel is patched every time it is turned on. An untethered jailbreak is a jailbreak that does not require any assistance when it reboots up. The kernel will be patched without the help of a computer or an application.
A tethered jailbreak is the opposite of an untethered jailbreak, in the sense that a computer is required to boot the device. Without a computer running the jailbreaking software, the iOS device will not be able to boot at all. While using a tethered jailbreak, the user will still be able to restart/kill the device's SpringBoard process without needing to reboot. Many early jailbreaks were offered initially as tethered jailbreaks.
This type of jailbreak allows a user to reboot their phone normally, but upon doing so, the jailbreak and any modified code will be effectively disabled, as it will have an unpatched kernel. Any functionality independent of the jailbreak will still run as normal, such as making a phone call, texting, or using App Store applications. To be able to have a patched kernel and run modified code again, the device must be booted using a computer.
This type of jailbreak is like a semi-tethered jailbreak in which when the device reboots, it no longer has a patched kernel, but the key difference is that the kernel can be patched without using a computer. The kernel is usually patched using an application installed on the device without patches. This type of jailbreak has become increasingly popular, with most recent jailbreaks classified as semi-untethered.
A few days after the original iPhone became available in July 2007, developers released the first jailbreaking tool for it, [35] and soon a jailbreak-only game app became available. [36] In October 2007, JailbreakMe 1.0 (also called "AppSnapp") allowed people to jailbreak iPhone OS 1.1.1 on both the iPhone and iPod Touch, [37] [38] and it included Installer.app as a way to get software for the jailbroken device. [39]
In February 2008, Zibri released ZiPhone, a tool for jailbreaking iPhone OS 1.1.3 and iPhone OS 1.1.4. [40]
The iPhone Dev Team, which is not affiliated with Apple, has released a series of free desktop-based jailbreaking tools. In July 2008 it released a version of PwnageTool to jailbreak the then new iPhone 3G on iPhone OS 2.0 as well as the iPod Touch, [41] [42] newly including Cydia as the primary third-party installer for jailbroken software. [43] PwnageTool continues to be updated for untethered jailbreaks of newer iOS versions. [44] [45]
In November 2008 the iPhone Dev Team released QuickPwn to jailbreak iPhone OS 2.2 on iPhone and iPod Touch, with options to enable past functionality that Apple had disabled on certain devices. [46]
After Apple released iPhone OS 3.0 in June 2009, the Dev Team published redsn0w as a simple jailbreaking tool for Mac and Windows, and also updated PwnageTool primarily intended for expert users making custom firmware, and only for Mac. [47] It continues to maintain redsn0w for jailbreaking most versions of iOS 4 and iOS 5 on most devices. [48]
George Hotz developed the first iPhone unlock. In 2009, he released a jailbreaking tool for the iPhone 3GS on iPhone OS 3.0 called purplera1n, [49] and blackra1n for iPhone OS version 3.1.2 on the 3rd generation iPod Touch and other devices. [50]
In October 2010, George Hotz released limera1n, a low-level boot ROM exploit that permanently works to jailbreak the iPhone 4 and is used as a part of tools including redsn0w. [51]
Nicholas Allegra (better known as "comex") released a program called Spirit in May 2010. [52] Spirit jailbreaks devices including iPhones running iPhone OS 3.1.2, 3.1.3, and iPad running iPhone OS 3.2. [52] In August 2010, comex released JailbreakMe 2.0, the first web-based tool to jailbreak the iPhone 4 (on iOS 4.0.1). [53] [54] In July 2011, he released JailbreakMe 3.0, [55] a web-based tool for jailbreaking all devices on certain versions of iOS 4.3, including the iPad 2 for the first time (on iOS 4.3.3). [56] It used a flaw in PDF file rendering in mobile Safari. [57] [58]
Chronic Dev Team initially released Greenpois0n in October 2010, a desktop-based tool for untethered jailbreaking iOS 4.1 [59] and later iOS 4.2.1 [60] on most devices including the Apple TV, [61] as well as iOS 4.2.6 on CDMA (Verizon) iPhones. [62]
As of December 2011, redsn0w included the "Corona" untether by pod2g for iOS 5.0.1 for iPhone 3GS, iPhone 4, iPad (1st generation), and iPod Touch (3rd and 4th generation). [45] As of June 2012, redsn0w also includes the "Rocky Racoon" untether by pod2g for iOS 5.1.1 on all iPhone, iPad, and iPod Touch models that support iOS 5.1.1. [63]
The iPhone Dev Team, Chronic Dev Team, and pod2g collaborated to release Absinthe in January 2012, a desktop-based tool to jailbreak the iPhone 4S for the first time and the iPad 2 for the second time, on iOS 5.0.1 for both devices and also iOS 5.0 for iPhone 4S. [64] [65] [66] [67] In May 2012 it released Absinthe 2.0, which can jailbreak iOS 5.1.1 untethered on all iPhone, iPad, and iPod Touch models that support iOS 5.1.1, including jailbreaking the third-generation iPad for the first time. [68]
An iOS 6.X untethered jailbreak tool called "evasi0n" was released for Linux, OS X, and Windows on February 4, 2013. [69] Due to the high volume of interest in downloading the jailbreak utility, the site initially gave anticipating users download errors. When Apple upgraded its software to iOS 6.1.3 it permanently patched out the evasi0n jailbreak. [70]
On November 29, 2014, TaiG team released their untethered jailbreak tool called "TaiG" for devices running iOS 8.0–8.1.1. On December 10, 2014, the app was updated to include support for iOS 8.1.2. [71] On July 3, 2015, TaiG 2.3.0 was released, which includes support for iOS 8.0–8.4. [72]
On October 14, 2015, Pangu Team released Pangu9, their untethered jailbreak tool for iOS 9.0 through 9.0.2. On March 11, 2016, Pangu Team updated their tool to support iOS 9.1 for 64-bit devices. [73] [74]
| Name | Release date | Hardware | Firmware | Untethered? | Developer(s) | License | |||
|---|---|---|---|---|---|---|---|---|---|
| iPad | iPhone | iPod Touch | Oldest | Recent | |||||
| JailbreakMe 3.0 [75] | July 5, 2011 [75] | [75] | 1 [75] | 4.2.6 | 4.2.8 4.3 – 4.3.3 [75] [lower-alpha 2] | Yes [75] | comex [75] | Proprietary | |
| Seas0npass [76] | October 18, 2011 [76] | 2nd generation Apple TV [76] | 4.3 | 5.3 6.1.2 (tethered) [76] | 4.3 – 5.3 [76] | GPLv3 [77] | |||
| redsn0w 0.9.15 beta 3 [78] [79] | November 1, 2012 | 1 [45] [78] [80] | 1 | 4.1 | 6.1.6 | Depends Untethered:
| iPhone Dev Team [45] | Proprietary | |
| Absinthe 2.0.4 [66] | May 30, 2012 | 1 [67] | 5.1.1 [67] | Yes [64] | pod2g, Chronic Dev Team, iPhone Dev Team [66] | Proprietary [83] | |||
| evasi0n | February 4, 2013 | 6.0 | 6.1.2 [84] | Yes | pod2g, MuscleNerd, pimskeks, and planetbeing (evad3rs) | Proprietary [85] | |||
| evasi0n7 | December 22, 2013 | 5 | 7.0 | 7.0.6 [84] | Yes | pod2g, MuscleNerd, pimskeks, and planetbeing (evad3rs) | Proprietary | ||
| p0sixspwn | December 30, 2013 | 6.1.3 | 6.1.6 | Yes | winocm, iH8sn0w, and SquiffyPwn | GPLv3 [86] | |||
| Pangu | June 23, 2014 [87] | 5 [87] | 7.1 | 7.1.2 | Yes | dm557, windknown, ogc557, and Daniel_K4 (@PanguTeam) | Proprietary | ||
| Pangu8 | October 22, 2014 | 5 | 8.0 | 8.1 | Yes | windknown, ogc557, Daniel_K4, zengbanxian, INT80 (@PanguTeam) | Proprietary | ||
| TaiG | November 29, 2014 | 8.0 | 8.4 | Yes | TaiG | Proprietary | |||
| PPJailbreak | January 18, 2015 | 8.0 | 8.4 | Yes | PanguTeam and PPJailbreak | Proprietary | |||
| Pangu9 | October 14, 2015 | 9.0 | 9.1 | Yes | PanguTeam | Proprietary | |||
| Pangu9 | March 23, 2016 | 4th generation Apple TV | 9.0 | 9.0.1 | Yes | PanguTeam | Proprietary | ||
| LiberTV | March 3, 2017 | 4th generation Apple TV | 9.1 | 10.1 | Semi-Untethered | Marco Grassi, Luca Todesco, Jonathan Levin | Proprietary | ||
| LiberTV 1.1 | December 24, 2017 | 4th & 5th generation (4K) Apple TV | 11.0 | 11.1 | Semi-Untethered | Marco Grassi, Luca Todesco, Jonathan Levin | Proprietary | ||
| PPJailbreak | July 24, 2016 | 9.2 | 9.3.3 | Semi-Untethered | PanguTeam and PPJailbreak | Proprietary | |||
| mach_portal + Yalu | December 22, 2016 | Pro | 6 | 10.0.1 | 10.1.1 (depends on device) | Semi-Untethered | Luca Todesco | ||
| yalu102 | January 26, 2017 | 6 | 10.0.1 | 10.2 | Semi-Untethered | Luca Todesco and Marco Grassi | WTFPL [88] | ||
| Phœnix | August 6, 2017 [89] | 9.3.5 | Semi-Untethered | Siguza and tihmstar | Proprietary | ||||
| Etason | September 19, 2017 [90] | 8.4.1 | Yes | tihmstar | Proprietary | ||||
| Saïgon | October 15, 2017 | 10.2.1 | Semi-Untethered | Abraham Masri | Proprietary [91] | ||||
| h3lix | December 24, 2017 | No support | 10.0 | 10.3.4 | Semi-Untethered | tihmstar | Proprietary | ||
| Meridian | January 4, 2018 | 10.0 | 10.3.3 | Semi-Untethered | Sparkey, Ian Beer, Siguza, xerub, stek29, theninjaprawn, ARX8x, cheesecakeufo, FoxletFox, Sticktron, nullpixel, arpolix, EthanRDoesMC, CydiaBen, Comsecuris UG, Brandon Saldan, Lepidus, Cryptic, Samg_is_a_Ninja, M1sta [92] | MIT [93] | |||
| g0blin | January 13, 2018 | 10.3 | 10.3.3 | Semi-Untethered | Sticktron, Siguza, Ian Beer, windknown, Luca Todesco, xerub, tihmstar, saurik, uroboro, Abraham Masri, arx8x, PsychoTea, Cryptic | Proprietary | |||
| Spyware.lol [94] | September 7, 2018 |
|
| 10.0 | 10.3.3 | Semi-Untethered | JakeBlair420 | Proprietary | |
| LiberiOS | December 25, 2017 | 6 | 11.0 | 11.1.2 | Semi-Untethered | Marco Grassi, Luca Todesco, Jonathan Levin, Ian Beer | Proprietary | ||
| Electra1112 | January 12, 2018 | 6 | 11.0 | 11.1.2 | Semi-Untethered | CoolStar, Ian Beer, xerub, Siguza, theninjaprawn, stek29, angelXwind, comex, isklikas, and goeo_, DHowett, and rpetrich | GPLv3 [95] | ||
| Electra1131 | July 7, 2018 | 6 | 11.0 | 11.4.1 | Semi-Untethered | CoolStar, Ian Beer, xerub, Siguza, theninjaprawn, Brandon Azad, stek29, Jamie Bishop, Pwn20wnd | GPLv3 [96] | ||
| ElectraTV | July 12, 2018 | 4th generation Apple TV | 11.0 | 11.4.1 | Semi-Untethered | nitoTV | |||
| unc0ver | October 13, 2018 | 11.0 | 14.8.1 (excludes 13.5.1) | Semi-Untethered | Pwn20wnd, Sam Bingner, Ian Beer, Brandon Azad, Jonathan Levin, xerub, sparkey, stek29, theninjaprawn | New BSD License [97] | |||
| Chimera | April 30, 2019 | 12.0 | 12.5.7 | Semi-Untethered | Coolstar, Jamie Bishop, tri'angle, ninjaprawn, Brandon Azad, PsychoTea, Ayden Panhuyzen, Umang Raghuvanshi, aesign | ||||
| checkra1n | November 10, 2019 |
| 12.0+ | 14.8.1 | Semi-Tethered [99] | argp, axi0mx, danyl931, jaywalker, kirb, littlelailo, nitoTV, nullpixel, pimskeks, qwertyoruiop, sbingner, siguza, haifisch, jndok, jonseals, xerub, lilstevie, psychotea, sferrini, Cellebrite, et al. | Proprietary | ||
| EtasonATV | January 22, 2020 | 3rd generation Apple TV | 7.4+ | Yes | tihmstar | Proprietary | |||
| Fugu | February 2, 2020 | All A10-A10X-based iPads | All A10-A10X-based iPhones | 7 | 13.0 | 13.5.1 | Semi-Tethered | Linus Henze | GPLv3 [100] |
| Odyssey | August 28, 2020 | All iPads that support iOS 13 | iPhone 6s or newer | 7 | 13.0 | 13.7 | Semi-Untethered | CoolStar, Hayden Seay, 23Aaron, Tihmstar | New BSD License [101] |
| Taurine | April 1, 2021 | A14 and below that support iOS 14 | A14 and below that support iOS 14 | 7 | 14.0 | 14.3 | Semi-Untethered | CoolStar, tihmstar, Diatrus, 23 Aaron, ModernPwner, pattern-f | BSD License [102] |
| Fugu14 | October 24, 2021 | All A12-A14-based iPads | All A12-A14-based iPhones | No support | 14.2 | 14.5.1 | Yes | Linus Henze | MIT [103] |
| p0laris [104] | April 20, 2022 | All A5/A5X-A6/A6X-based devices | 5 | 9.3.5 | 9.3.6 | Semi-Untethered | spv | LGPLv2.1 [105] | |
| openpwnage [106] | May 19, 2022 | All A5/A5X-A6/A6X-based devices | 5 | 8.4b4 | 9.3.6 | Semi-Untethered | 0xilis | LGPLv2.1 [107] | |
| Blizzard Jailbreak [108] | August 4, 2022 | All A5/A5X-A6/A6X-based devices | 5 | 8.4b4 | 9.3.6 | Semi-Untethered | GeoSn0w | LGPLv3.0 [109] | |
| palera1n | September 17, 2022 | A11 and below that support iOS 15/16/17 | A11 and below that support iOS 15/16 | 7 | 15.0 | 17.3 | Semi-Tethered [lower-alpha 3] | Nebula, Mineek, Nathan, Lakhan Lothiyi, Tom, Nick Chan, Flower | MIT [111] |
| XinaA15 [112] | December 7, 2022 | All A12-A15 based devices M1 based iPads | No support | 15.0 | 15.4.1 | Semi-Untethered | Xina520 | Proprietary | |
| Dopamine [113] | May 3, 2023 | All A9-A16, M1-M2 based iPads | All A9-A16 based iPhones | 7 | 15.0 | 16.6.1 (A9-A11) | Semi-Unthethered | Lars Fröder | MIT [114] |
| Bootstrap [115] | February 7, 2024 | All A8-A15 based devices | 7 | 15.0 | 17.0 | Semi-Untethered | Tb | MIT [116] | |
Apple has released various updates to iOS that patch exploits used by jailbreak utilities; this includes a patch released in iOS 6.1.3 to software exploits used by the original evasi0n iOS 6–6.1.2 jailbreak, in iOS 7.1 patching the Evasi0n 7 jailbreak for iOS 7–7.0.6-7.1 beta 3. Boot ROM exploits (exploits found in the hardware of the device) cannot be patched by Apple system updates but can be fixed in hardware revisions such as new chips or new hardware in its entirety, as occurred with the iPhone 3GS in 2009. [117]
On July 15, 2011, Apple released a new iOS version that closed the exploit used in JailbreakMe 3.0. The German Federal Office for Information Security had reported that JailbreakMe uncovered the "critical weakness" that information could be stolen or malware unwillingly downloaded by iOS users clicking on maliciously crafted PDF files. [118]
On August 13, 2015, Apple updated iOS to 8.4.1, patching the TaiG exploit. Pangu and Taig teams both said they were working on exploiting iOS 8.4.1, and Pangu demonstrated these chances at the WWDC 2015. [119] [ clarification needed ]
On September 16, 2015, iOS 9 was announced and made available; it was released with a new "Rootless" security system, dubbed a "heavy blow" to the jailbreaking community. [120]
On October 21, 2015, seven days after the Pangu iOS 9.0–9.0.2 Jailbreak release, Apple pushed the iOS 9.1 update, which contained a patch that rendered it nonfunctional. [121]
On January 23, 2017, Apple released iOS 10.2.1 to patch jailbreak exploits released by Google for the Yalu iOS 10 jailbreak created by Luca Todesco. [122]
On December 10, 2019, Apple used DMCA takedown requests to remove posts from Twitter. The tweet contained an encryption key that could potentially be used to reverse engineer the iPhone's Secure Enclave. Apple later retracted the claim, and the tweet was reinstated. [123]
On June 1, 2020, Apple released the 13.5.1 update, patching the 0 day exploit used by the Unc0ver jailbreak. [124]
On September 20, 2021, Apple released iOS/iPadOS 15, which introduced signed system volume security to iOS/iPadOS, meaning that any changes to the root file system would revert to the latest snapshot on a reboot, and changes to the snapshot would make the device unbootable. [125] As a result, jailbreak development slowed considerably, and for the first time in jailbreaking history, the latest iPhone did not get a jailbreak before a new model was released.
On September 12, 2022, Apple released iOS 16, which introduced a new firmware component known as Cryptex1. New Cryptex1 versions are almost never compatible with old iOS versions, making downgrading impossible except within patch versions (i.e. 16.3 and 16.3.1).[ citation needed ]
The legal status of jailbreaking is affected by laws regarding circumvention of digital locks, such as laws protecting digital rights management (DRM) mechanisms. Many countries do not have such laws, and some countries have laws including exceptions for jailbreaking.
International treaties have influenced the development of laws affecting jailbreaking. The 1996 World Intellectual Property Organization (WIPO) Copyright Treaty requires nations party to the treaties to enact laws against DRM circumvention. The American implementation is the Digital Millennium Copyright Act (DMCA), which includes a process for establishing exemptions for non-copyright-infringing purposes such as jailbreaking. The 2001 European Copyright Directive implemented the treaty in Europe, requiring member states of the European Union to implement legal protections for technological protection measures. The Copyright Directive includes exceptions to allow breaking those measures for non-copyright-infringing purposes, such as jailbreaking to run alternative software, [126] but member states vary on the implementation of the directive.
While Apple technically does not support jailbreaking as a violation of its EULA, jailbreaking communities have generally not been legally threatened by Apple. At least two prominent jailbreakers have been given positions at Apple, albeit in at least one case a temporary one. [127] [128] Apple has also regularly credited jailbreak developers with detecting security holes in iOS release notes. [129]
Apple's support article concerning jailbreaking claims that they "may deny service for an iPhone, iPad, or iPod Touch that has installed any unauthorized software," which includes jailbreaking. [130]
In 2010, Electronic Frontiers Australia said that it is unclear whether jailbreaking is legal in Australia, and that anti-circumvention laws may apply. [131] These laws had been strengthened by the Copyright Amendment Act 2006.
In November 2012, Canada amended its Copyright Act with new provisions prohibiting tampering with DRM protection, with exceptions including software interoperability. [132] Jailbreaking a device to run alternative software is a form of circumventing digital locks for the purpose of software interoperability.
There had been several efforts from 2008–2011 to amend the Copyright Act (Bill C-60, Bill C-61, and Bill C-32) to prohibit tampering with digital locks, along with initial proposals for C-11 that were more restrictive, [133] but those bills were set aside. In 2011, Michael Geist, a Canadian copyright scholar, cited iPhone jailbreaking as a non-copyright-related activity that overly-broad Copyright Act amendments could prohibit. [134]
India's copyright law permits circumventing DRM for non-copyright-infringing purposes. [135] [136] Parliament introduced a bill including this DRM provision in 2010 and passed it in 2012 as Copyright (Amendment) Bill 2012. [137] India is not a signatory to the WIPO Copyright Treaty that requires laws against DRM circumvention, but being listed on the US Special 301 Report "Priority Watch List" applied pressure to develop stricter copyright laws in line with the WIPO treaty. [135] [136]
New Zealand's copyright law allows the use of technological protection measure (TPM) circumvention methods as long as the use is for legal, non-copyright-infringing purposes. [138] [139] This law was added to the Copyright Act 1994 as part of the Copyright (New Technologies) Amendment Act 2008.
Jailbreaking might be legal in Singapore if done to provide interoperability and not circumvent copyright, but that has not been tested in court. [140]
The law Copyright and Related Rights Regulations 2003 makes circumventing DRM protection measures legal for the purpose of interoperability but not copyright infringement. Jailbreaking may be a form of circumvention covered by that law, but this has not been tested in court. [126] [141] Competition laws may also be relevant. [142]
The main law that affects the legality of iOS jailbreaking in the United States is the 1998 Digital Millennium Copyright Act (DMCA), which says "no person shall circumvent a technological measure that effectively controls access to a work protected under" the DMCA, since this may apply to jailbreaking. [143] Every three years, the law allows the public to propose exemptions for legitimate reasons for circumvention, which last three years if approved. In 2010 and 2012, the U.S. Copyright Office approved exemptions that allowed smartphone users to jailbreak their devices legally, [144] and in 2015 the Copyright Office approved an expanded exemption that also covers other all-purpose mobile computing devices, such as tablets. [145] It is still possible Apple may employ technical countermeasures to prevent jailbreaking or prevent jailbroken phones from functioning. [146] It is unclear whether it is legal to traffic in the tools used to make jailbreaking easy. [146]
In 2010, Apple announced that jailbreaking "can violate the warranty". [147]
In 2007, Tim Wu, a professor at Columbia Law School, argued that jailbreaking "Apple's superphone is legal, ethical, and just plain fun." [148] Wu cited an explicit exemption issued by the Library of Congress in 2006 for personal carrier unlocking, which notes that locks "are used by wireless carriers to limit the ability of subscribers to switch to other carriers, a business decision that has nothing whatsoever to do with the interests protected by copyright" and thus do not implicate the DMCA. [149] Wu did not claim that this exemption applies to those who help others unlock a device or "traffic" in software to do so. [148]
In 2010, in response to a request by the Electronic Frontier Foundation, the U.S. Copyright Office explicitly recognized an exemption to the DMCA to permit jailbreaking in order to allow iPhone owners to use their phones with applications that are not available from Apple's store, and to unlock their iPhones for use with unapproved carriers. [150] [151] Apple had previously filed comments opposing this exemption and indicated that it had considered jailbreaking to be a violation of copyright (and by implication prosecutable under the DMCA). Apple's request to define copyright law to include jailbreaking as a violation was denied as part of the 2009 DMCA rulemaking. In their ruling, the Library of Congress affirmed on July 26, 2010, that jailbreaking is exempt from DMCA rules with respect to circumventing digital locks. DMCA exemptions must be reviewed and renewed every three years or else they expire.
On October 28, 2012, the US Copyright Office released a new exemption ruling. The jailbreaking of smartphones continued to be legal "where circumvention is accomplished for the sole purpose of enabling interoperability of [lawfully obtained software] applications with computer programs on the telephone handset." However, the U.S. Copyright office refused to extend this exemption to tablets, such as iPads, arguing that the term "tablets" is broad and ill-defined, and an exemption to this class of devices could have unintended side effects. [152] [153] [154] The Copyright Office also renewed the 2010 exemption for unofficially unlocking phones to use them on unapproved carriers, but restricted this exemption to phones purchased before January 26, 2013. [153] In 2015, these exemptions were extended to include other devices, including tablets. [155]
The first iPhone worm, iKee, appeared in early November 2009, created by a 21-year-old Australian student in the town of Wollongong. He told Australian media that he created the worm to raise awareness of security issues: jailbreaking allows users to install an SSH service, which those users can leave in the default insecure state. [156] In the same month, F-Secure reported on a new malicious worm compromising bank transactions from jailbroken phones in the Netherlands, similarly affecting devices where the owner had installed SSH without changing the default password. [157] [158]
Restoring a device with iTunes removes a jailbreak. [159] [160] [161] However, doing so generally updates the device to the latest, and possibly non-jailbreakable, version, due to Apple's use of SHSH blobs. There are many applications that aim to prevent this, by restoring the devices to the same version they are currently running whilst removing the jailbreaks. Examples are, Succession, Semi-Restore and Cydia Eraser.
In 2012, Forbes staff analyzed a UCSB study on 1,407 free programs available from Apple and a third-party source. Of the 1,407 free apps investigated, 825 were downloaded from Apple's App Store using the website App Tracker, and 526 from BigBoss (Cydia's default repository). 21% of official apps tested leaked device ID and 4% leaked location. Unofficial apps leaked 4% and 0.2% respectively. 0.2% of apps from Cydia leaked photos and browsing history, while the App Store leaked none. Unauthorized apps tended to respect privacy better than official ones. [162] Also, a program available in Cydia called PrivaCy allows user to control the upload of usage statistics to remote servers. [162]
In August 2015, the KeyRaider malware was discovered, affecting only jailbroken iPhones. [163]
In recent years, due to the technical complexity and often rarity of legitimate jailbreaking software (especially untethered jailbreaks) there has been an increase in websites offering fake iOS jailbreaks. These websites often ask for payment or make heavy use of advertising, but have no actual jailbreak to offer. Others install a fake, lookalike version of the Cydia package manager. [164] In some cases, users have been asked to download free-to-play apps or fill out surveys to complete a (non-existent) jailbreak.
Xcode is Apple's integrated development environment (IDE) for macOS, used to develop software for macOS, iOS, iPadOS, watchOS, tvOS, and visionOS. It was initially released in late 2003; the latest stable release is version 15, released on September 18, 2023, and is available free of charge via the Mac App Store and the Apple Developer website. Registered developers can also download preview releases and prior versions of the suite through the Apple Developer website. Xcode includes command-line tools that enable UNIX-style development via the Terminal app in macOS. They can also be downloaded and installed without the GUI.
Privilege escalation is the act of exploiting a bug, a design flaw, or a configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. The result is that an application with more privileges than intended by the application developer or system administrator can perform unauthorized actions.
The iPod Touch is a discontinued line of iOS-based mobile devices designed and formerly marketed by Apple Inc. with a touchscreen-controlled user interface. As with other iPod models, the iPod Touch can be used as a portable media player and a handheld gaming device, but can also be used as a digital camera, a web browser, for email and messaging. It is nearly identical in design to the iPhone, and can run most iPhone third-party apps from the App Store, but it connects to the Internet only through Wi-Fi and uses no cellular network data, as it lacks a cellular modem.
iOS is a mobile operating system developed by Apple Inc. exclusively for its smartphones. It was unveiled in January 2007 for the first-generation iPhone, launched in June 2007.
SpringBoard is the standard application that manages the iPhone's home screen. Other tasks include starting WindowServer, launching and bootstrapping applications and setting some of the device's settings on startup.
iOS is a mobile operating system developed by Apple Inc. and was first released as iPhone OS in June 2007, coinciding with the launch of the first generation iPhone. iPhone OS was renamed iOS following the release of the iPad, starting with iOS 4. With iOS 13, Apple began offering a separate operating system, iPadOS, for the iPad. iOS is also the foundation of the newer audioOS and tvOS, and shares some of its code with macOS. New iOS versions are released every year alongside new iPhone models. From its launch in 2007 until 2010, this occurred in June or July, since then, new major versions are released in September or October. Since the launch of the iPhone in June 2007, there have been 17 major releases of iOS. The current major version of iOS is iOS 17, released on September 18, 2023.
The Digital Millennium Copyright Act (DMCA) is a 1998 United States copyright law that implements two 1996 treaties of the World Intellectual Property Organization (WIPO). It criminalizes production and dissemination of technology, devices, or services intended to circumvent measures that control access to copyrighted works. It also criminalizes the act of circumventing an access control, whether or not there is actual infringement of copyright itself. In addition, the DMCA heightens the penalties for copyright infringement on the Internet. Passed on October 12, 1998, by a unanimous vote in the United States Senate and signed into law by President Bill Clinton on October 28, 1998, the DMCA amended Title 17 of the United States Code to extend the reach of copyright, while limiting the liability of the providers of online services for copyright infringement by their users.
Cydia is a graphical user interface of APT for iOS. It enables a user to find and install software not authorized by Apple on jailbroken iPhones, iPads and iPod Touch devices. It also refers to the digital distribution platform for software on iOS accessed through Cydia software. Most of the software packages available through Cydia are free of charge, although some require purchasing.
The iPad is a brand of iOS and iPadOS-based tablet computers that are developed by Apple Inc., first introduced on January 27, 2010. The iPad range consists of the original iPad lineup and the flagship products iPad Mini, iPad Air, and iPad Pro.
A .ipa file is an iOS and iPadOS application archive file which stores an iOS/iPadOS app. Each .ipa file includes a binary and can only be installed on an iOS, iPadOS, or ARM-based macOS device. Files with the .ipa extension can be uncompressed by changing the extension to .zip and unzipping. This is only recommended when editing the app itself. Some ipa's will not have a .app file.
Rooting is the process by which users of Android devices can attain privileged control over various subsystems of the device, usually smartphones and tablets. Because Android is based on a modified version of the Linux kernel, rooting an Android device gives similar access to administrative (superuser) permissions as on Linux or any other Unix-like operating system such as FreeBSD or macOS.
Jay Ryan Freeman is an American businessman and software engineer. He is known for creating the Cydia software application and related software for jailbroken iOS—a modified version of Apple's iOS that allows for the installation and customization of software outside of the regulation imposed by the App Store system.
In computing, a SHSH blob is a digital signature that Apple generates and uses to control the iOS versions that users can install on their iOS devices generally only allowing the newest iOS version to be installable. Apple's public name for this process is System Software Authorization. The term “SHSH blob” is unofficial and based on abbreviations for signed hash and binary large object. An alternative term, ECID SHSH, refers to the device's ECID, a unique identification number embedded in its hardware)
JailbreakMe is a series of jailbreaks for Apple's iOS mobile operating system that took advantage of flaws in the Safari browser on the device, providing an immediate one-step jailbreak, unlike more common jailbreaks, such as Blackra1n and redsn0w, that require plugging the device into a computer and running the jailbreaking software from the desktop. JailbreakMe included Cydia, a package management interface that serves as an alternative to the App Store. Although it does not support modern devices, it can still be used and the site is up.
greenpois0n is a name shared by a series of iOS jailbreaking tools developed by Chronic Dev Team that use exploits to remove software restrictions on iPhones, iPads, iPod Touches, and Apple TVs. Greenpois0n's initial release in October 2010 jailbroke iOS 4.1, and its second version in February 2011 jailbroke iOS 4.2.1 as well as iOS 4.2.6 on CDMA iPhones. The second generation of the tool, greenpois0n Absinthe, was developed with iPhone Dev Team members and jailbroke iOS 5.0.1 in January 2012, and a second version jailbroke iOS 5.1.1 in May 2012.
The hacking of consumer electronics is an common practice that users perform to customize and modify their devices beyond what is typically possible. This activity has a long history, dating from the days of early computer, programming, and electronics hobbyists.
iMessage is an instant messaging service developed by Apple Inc. and launched in 2011. iMessage functions exclusively on Apple platforms – including macOS, iOS, iPadOS, and watchOS – as part of Apple's broader strategic approach to inter device integration, sometimes referred to as the Apple Eco-System.
The iPad is a tablet computer, developed and marketed by Apple Inc. It is the third device in the iPad line of tablets. It added a Retina Display, the new Apple A5X chip with a quad-core graphics processor, a 5-megapixel camera, HD 1080p video recording, voice dictation, and support for LTE networks in North America. It shipped with iOS 5, which provides a platform for audio-visual media, including electronic books, periodicals, films, music, computer games, presentations and web browsing.
The Unlocking Consumer Choice and Wireless Competition Act is a United States public law that repeals a rulemaking determination by the United States Copyright Office that left it illegal for people to unlock their cellphones.
The Pangu Team, is a Chinese programming team in the iOS community that developed the Pangu jailbreaking tools. These are tools that assist users in bypassing device restrictions and enabling root access to the iOS operating system. This permits the user to install applications and customizations typically unavailable through the official iOS App Store.
[U]nauthorized modification of iOS is a violation of the iOS end-user software license agreement and because of this, Apple may deny service for an iPhone, iPad, or iPod Touch that has installed any unauthorized software.
{{cite web}}: CS1 maint: unfit URL (link) iOS and iOS-based products | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Hardware |
|  | |||||||||||||||||||||||||
| Software |
| ||||||||||||||||||||||||||
| Services |
| ||||||||||||||||||||||||||
| Other | |||||||||||||||||||||||||||
| |||||||||||||||||||||||||||
