New untethered jailbreak works for iDevices running iOS 6.x

[Arthur]

Finally!

 

Source: Ars Technica

 

An iOS hacking team that calls itself "evad3rs" has released a tool to jailbreak devices running iOS 6. The tool, called "evasi0n," is available for OS X, Windows, and Linux. It can jailbreak iOS 6.0, 6.0.1, 6.0.2, and 6.1 on all compatible iPhones, iPads, and iPod touches.

 

For those unfamiliar with jailbreaking, it's a process that defeats the built-in security and DRM features of iOS, allowing greater flexibility in customization, the ability to install apps outside of the official App Store, and access to iOS's underlying UNIX internals. Jailbreakers tend to use the technique to enable functionality that isn't part of iOS, or to customize the look of icons and other elements. Some also use it to unlock devices from particular carriers or to install software otherwise barred (and sometimes pirated) from the App Store.

 

Jailbreaking tools typically rely on some undocumented flaw that enables working around iOS's security measures. As such, each new version of iOS usually patches flaws once they are exploited by jailbreaking tools, so each version of iOS often requires a new jailbreak tool. evasi0n uses a previously undisclosed exploit that works on all available versions of iOS 6. It also works "untethered," meaning the iOS device doesn't need to be plugged into a computer to re-enable the jailbreak every time the device is rebooted.

 

http://i.imgur.com/Zp0U18H.jpg

[Arthur]

The following article describes how Evasi0n pulled it off.

 

Evasi0n Jailbreak's Userland Component

 

Evasi0n is interesting because it escalates privileges and has full access to the system partition all without any memory corruption. It does this by exploiting the /var/db/timezone vulnerability to gain access to the root user’s launchd socket. It then abuses launchd to load MobileFileIntegrity with an inserted codeless library, which is overriding MISValidateSignature to always return 0.