Jailbreaking iOS frees you from Apple but exposes you to malware

While Apple’s Mac OS X reputation for superior security to Windows has little technical basis, iOS (the operating system for iPhones and iPads) is a very different story. As such, when nearly a quarter of a million Apple accounts were compromised by malware recently, it was a big surprise for many people.

So far Apple has been able to keep the iPhone and iPad almost completely free of malware. While iOS malware – some of it apparently created by intelligence agencies – does exist, only a minority of users have been vulnerable to most of it.

And to be vulnerable, an iOS device must first be “jailbroken”.

iOS’s “jail” – or to put it more diplomatically: its “walled garden” – is at the root of its impressive security record. But this comes at a price that some users are not willing to pay, and this places them at greater risk of being hacked.

iOS security: signatures required

Every iOS device contains special hardware and software designed to ensure that only software authorised by Apple can be run on it.

Every piece of software that runs on an iOS device, including iOS itself, must be digitally “signed” by Apple with the private half of a two-part digital “key”. Each iOS device has the “public” half of the key. Before any piece of software is allowed to run, the phone uses the public key to check whether the software signature is authentic and applies to the software actually present on the device. If either the software or the signature have been modified, the software will not run.

This signature is practically impossible to forge without access to Apple’s private key. And, thus far, the mechanisms within iOS for checking signatures have been pretty much watertight, at least without physically connecting the phone to a computer with a USB cable.

Related mechanisms allow Apple to restrict a downloaded app from running on an iOS device or to revoke permission for an app to run at any time. Notably, this means that using illegally copied software is impossible on an unmodified iOS device.

All apps on Apple’s App Store are signed by Apple. These apps are made available on the App Store only after they have undergone an extensive vetting process according to the company’s published guidelines.

While keeping malware and other forms of objectionable software off the App Store is a primary goal, the guidelines also impose commercial restrictions. For example, subscription apps must use Apple’s payment mechanism, on which Apple collects a 30% commission.

This practice has attracted negative comment from US federal Senator Al Franken, who has asked the Federal Trade Commission to investigate what he views as potentially illegal anti-competitive behaviour under US law.

Jailbreaking can give you – or hackers – access to the guts of your device.MIKI Yoshihito/Flickr, CC BY

Tinkerers, pirates and foreign language speakers

Some iOS users are unwilling to accept the restrictions imposed on them by Apple, or sometimes Apple-authorised apps, for a variety of reasons. To circumvent these restrictions, they take advantage of flaws in iOS’s security regime to install additional non-authorised software by first “jailbreaking” their device.

Jailbreaking an iOS device requires a program such as TaiG, which anonymous programmers have made available at no cost. A user downloads TaiG to their PC or Mac, connects their iOS device and then runs TaiG.

As well as allowing the user unfettered access to the files hidden behind the scenes on their iOS device, TaiG installs a “package manager” called Cydia. Through this they can install new apps unapproved by Apple, which are available from a variety of third-party repositories, as well as “tweaks” to modify existing apps.

Some of the extra functionality downloadable through Cydia includes a tweak to allow easy saving of photos on an Instagram feed, modifying the system fonts and improved Chinese language input. Historically, Apple’s stock iOS Chinese keyboard has been inferior to unauthorised third-party keyboards.

However, it can’t be denied that the ability to install pirated software is also attractive to some iOS users. It appears this was both the downfall of the victims of the recent hack and a goal of the hackers.

The malware was distributed as a “Trojan horse” through repositories of (mainly pirated) software accessible through Cydia in China (although it was not managed by the Cydia creator itself). Once installed, it stole the Apple account credentials of the user who installed the malware.

This allowed the hackers to use those accounts to purchase items from the iOS App Store for somebody else’s use. The malware could also be used to hold a phone to ransom, or steal the information stored in the cloud on the Apple account.

Whom do you trust?

As a user, I find Apple’s attitude that it is the ultimate arbiter of what’s appropriate for me to do with my device somewhat irritating. But this policy has also been very effective at keeping malware out of the iOS ecosystem, all without the need for consumers to invest in additional anti-malware software.

Outside the iOS jail, the burden of keeping malware off one’s phone falls entirely to the user and their judgement. It’s a virtual Wild West, replete with outlaws looking to exploit the unwary.

While I sympathise with Chinese users burdened with inefficient native language input, for most of us it’s hard to see that “cool” animations and other non-authorised apps are worth the risk of malware infection.

Robert Merkel does not work for, consult, own shares in or receive funding from any company or organization that would benefit from this article, and has disclosed no relevant affiliations beyond the academic appointment above.