Jay Freeman (saurik)

Agreed, the websites with the least effort put in seem to be owned by the best programmers in my experience Another one: http://saurik.com

I'm cited on the first page of this paper (reference 20) for my work on the Android Master Key vulnerability (which I didn't find, to be clear, but I did most of the exploitation people saw), and, while this paper looks AWESOME (and I'm very excited to read it in detail), if you are interested in this concept but feel you need something a bit more concrete--maybe with diagrams and some hand-holding--to understand what is going on, I will recommend my series of articles on Master Key as an introduction. https://www.saurik.com/masterkey1.html https://www.saurik.com/masterkey2.html https://www.saurik.com/masterkey3.html

It's not just any white hat hacker, it's saurik who was behind the original jailbreaking tools for iOS and the creator of Cydia, the unofficial app store back then. He is also now the "CTO" (if the term applies) of a well-known blockchain-based VPN, Orchid. Edit: He has a great write-up about the vulnerability and its discovery on his blog: https://www.saurik.com/optimism.html (which was on HN a couple days ago)

> Apple has a precedent for open source technologies like this. They also have a precedent for being less than friendly towards FOSS[0][1][2][3], despite the way they try to present themselves otherwise by listing their open source contributions prominently. Note that the author of these comments, saurik, is Jay Freeman, the creator of Cydia. Key quotes include: > Apple has simply never been in compliance with the LGPL [for WebCore]. > As for Oracle, I think Apple is much more harmful [to open source] > I have gotten so used to Apple giving open source the finger, and thereby have backup plans involving disassembles for most of the things I care about at this point, I had forgotten to even follow up on them failing to release anything [0] https://news.ycombinator.com/item?id=2083953 [1] https://news.ycombinator.com/item?id=2523784 [2] https://news.ycombinator.com/item?id=9377345 [3] http://www.saurik.com/id/4

For iOS 4.1, which came out in September 2010, absolutely no GPL code for it (or later versions, like 4.2) was posted until March 2011. That's not 8 weeks: that's about 6 months. When comex (http://twitter.com/comex) and saurik (http://saurik.com/) asked for it (via emails to [email protected] and [email protected]) around last November, I don't think they got any response from Apple —until this year. Then, Apple let them know that it would be up "within a week". I think the iOS 4.1 and 4.2 code actually went up about three weeks after they received that email. saurik has even more examples of them not releasing the [L]GPL'd code near the top of this post: http://www.saurik.com/id/4 — "Frankly, I wouldn't be surprised at all if Apple ends up on the bad end of a GPL-related lawsuit." (In my opinion, the fact Apple has posted any code for iOS 4.3 at this point is a big step in the right direction: they're not perfect yet, but at least they've got 8/10 of the projects up.)

saurik got $2.1M from Optimism/Boba Network via Immunefi https://www.saurik.com/optimism.html

Thanks, I only read the article linked and had not yet dug any further. I appreciate how much work you put into this! For anyone who may have missed the link in the article or thread, this is it: https://www.saurik.com/optimism.html

I'm pretty sure iOS updates are signed per device, as that's why everyone backs up their signatures for old versions (so that they can go back while Apple isn't signing them). So Apple could only sign this backdoor for one device. http://www.saurik.com/id/12

Also, Apple does have the ability to prevent signed updates from being installed on phones they don't want it to be. Every update must be signed by Apple specifically to the phone that's being updated, and this includes a nonce to prevent replay attacks. (I forgot about this in my reply above). See https://en.wikipedia.org/wiki/SHSH_blob, https://www.theiphonewiki.com/wiki/SHSH, http://www.saurik.com/id/12

Signature verification for android applications has been a tough one: http://www.saurik.com/id/19

This is a very good point, and something that was also touched on in http://www.saurik.com/id/20 recently.

>In addition, I'm not sure what Saurik, the creator of Cydia, has to do with this discussion at all. He has found various security bugs in Android (most recent example: http://www.saurik.com/id/19 from the other day) and he is also the developer of http://www.cydiaimpactor.com atmosx's point was that it isn't 'skiddies' who are finding these security holes, it's experienced developers and security researchers.

> > you need to have a Mac to develop iPhone or OS X apps > This backs up my previous point. Why can't I develop iOS apps on Linux? You can. http://www.saurik.com/id/4

Android also has a native C/C++ development kit. http://arstechnica.com/open-source/news/2009/06/android-goes-beyond-ja… You can also cross-compile iPhone apps on Linux, however, you won't be able to sell it at their app store. http://www.saurik.com/id/4 Another alternative is the Nokia N900 which uses maemo. http://maemo.nokia.com/ http://maemo.nokia.com/n900/

Somehow hackers are pirating iPhone apps right now (you can find pirated apps for free to install on jailbroken iphones). I don't know how they are doing it, but if the Mac App Store will work the same way, they've already solved it. if i'm not mistaken, on the iphone they've just disabled the kernel checks that require binaries to be signed before running. http://www.saurik.com/id/8 i'm not sure how apple is doing it on osx because it has to run lots of binaries that will never be signed.

There's a pretty good write-up of installing a Debian userland on the G1, but the link seems dead today. Maybe this will work later: http://www.saurik.com/id/10 In the meantime, here's the Google Cache version: http://74.125.45.132/search?q=cache:qTYLZQyrPnQJ:www.saurik.com/id/10&…

Creating Cydia Substrate certainly involved a ton of reverse engineering, but I get the sense creating tweaks on top of Substrate is a lot closer to Greasemonkey. There are also tools like Flipboard Explorer[1] that make it easy to see how an iOS view is constructed and what needs to be modified, very similar to a web browser's inspector. There's a line in a blog post[2] Saurik (Substrate's creator) wrote a while back: > In general, I also believe the algorithms for reverse engineering have started getting better faster than the technology behind binary obfuscation. [...] I believe that we will find the distinction between closed source and open source crumbling—not just for people like comex and myself, but for the average developer. He also references a longer talk he gave on the subject. Disclaimer that I haven't watched it. https://www.youtube.com/watch?v=D91jVZ4Z6og Note that all of this absolutely still requires programming though. And Flex is absolutely not a programming tool, although the wealth of options it opens up is very substantial, since you can modify the return value of just about any method. --- [1] https://github.com/Flipboard/FLEX (Note: Flipboard Explorer's abbreviated name is "FLEX". It has no relation to the other software I mentioned, "Flex".) [2] http://www.saurik.com/id/22

My understanding is that when you install iOS on an iPhone, an Apple server signs the OS as part of a challenge-response protocol. The challenge includes a unique device ID, and I believe the signed iOS is only installable on a device with that ID. http://www.saurik.com/id/12 has more details. Think about this in the context of jailbreaking to understand why such a facility exists. Apple doesn't want users to install their own modifications to iOS, and they also don't want users to install old versions of iOS that have vulnerabilities that would allow people to modify the OS. One way you could implement something like this is to have a public/private keypair within the device and have updates encrypted with the public key; then design the device to only run an OS that it could decrypt with its private key. To do this well, you would need a TPM that did not allow the private key to leave the device, nor to be reset.

Also, this has been possible since basically the first version of Android: http://www.saurik.com/id/10 . It's just a chroot jail, taking advantage of the fact that there are ARM versons of Debian/Ubuntu. Complete Linux Installer and other similar apps are nice because they save you the trouble of remembering a bunch of commands or downloading and running a script, but even they are doing nothing besides downloading an image and running a script. This is far from a usable experience. Notably, Android doesn't have an X server so you have to use VNC to get a GUI so a GUI is effectively useless. It's kind of handy to have proper GNU userland instead of Busybox sometimes and you can do silly things like run a local webserver and edit files using Emacs/vim/etc, but unless you're on a tablet with a keyboard attached somehow it's not practical at all. This has no relation to Ubuntu's efforts to make a proper port of Ubuntu to phones.