iOS jailbreaking is the process of removing the limitations imposed by Apple on devices running the iOS operating system through the use of custom kernels — such devices include the iPhone, iPod touch, iPad, and 2nd generation Apple TV. Jailbreaking allows iOS users to gain root access to the operating system, allowing them to download additional applications, extensions, and themes that are unavailable through the official Apple App Store. Jailbreaking is a form of privilege escalation, and the term has been applied to privilege escalation on other computer systems as well. The name refers to breaking the device out of its "jail",^[1] which is a technical term used in Unix-style systems, for example in the term "FreeBSD jail". A jailbroken iPhone, iPod touch, or iPad running iOS can still use the App Store, iTunes, and other normal functions, such as making telephone calls.

Unlike rooting an Android device, jailbreaking is necessary if the user intends to run software not authorized by Apple. Under the Digital Millennium Copyright Act, jailbreaking iPhones is legal in the United States, although Apple has announced that the practice "can violate the warranty".^[2]

Reasons for jailbreaking[link]

Cydia displaying a list of software available for jailbroken devices.

Added features

One of the main reasons for jailbreaking is to expand the feature set limited by Apple and its App Store. Most jailbreaking tools automatically install Cydia, a native iOS APT client used for finding and installing software for jailbroken iOS devices.^[3] Since software programs available through Cydia are not required to adhere to App Store guidelines, many of them are not typical self-contained apps but instead are extensions and customizations for iOS and other apps.^[4] Users install these programs for purposes including personalization and customization of the interface,^[4] adding desired features and fixing annoyances,^[5] and making development work on the device easier by providing access to the filesystem and command-line tools.^[6][7]

Use of handset on multiple networks

Jailbreaking also opens the possibility for using software to unofficially unlock carrier-locked iPhones so they can be used with other carriers.^[8] Software-based unlocks have been available since 2008,^[9] with each tool applying to a specific iPhone model and baseband version (or multiple models and versions).^[10]

Censorship

Some users look to software outside the App Store to express opposition to Apple's censorship of content through the app approval process: in early 2010, Apple banned an app submitted by Pulitzer Prize-winning cartoonist, Mark Fiore, because it "ridiculed public figures", in violation of Section 3.3.14 of the iPhone Developer Program License Agreement. Apple later called Fiore and asked him to resubmit his app for approval.^[11] In late 2010, Apple banned the use of apps that allowed users to donate money to non-profit organization and charities.^[12] Apple also banned a WikiLeaks app, stating it "violated their developer guidelines".^[13] As the list of banned apps continues to grow, some users have found jailbreaking to be a viable alternative to Apple’s censorship of content.^[14]

Installing software published outside the App Store has the potential to affect battery life and system stability if the software is poorly optimized or frequently uses resource-draining services (such as 3G or Wi-Fi).^[15][16][17]

Security[link]

The first iPhone worm, iKee, appeared in early November 2009, created by 21-year-old Australian student Ashley Towns of Wollongong. He told Australian media that he created the worm to raise awareness of security issues: jailbreaking allows users to install a SSH service, which those users can leave in the default unsecure state.^[18] In the same month, F-Secure reported on a new malicious worm compromising bank transactions from jailbroken phones in the Netherlands, similarly affecting devices where the owner had installed SSH without changing the default password.^[19][20]

On July 15, 2011, Apple released a new version of iOS that closed the exploit used in JailbreakMe 3.0. The German Federal Office for Information Security had reported that the "critical weakness" uncovered by JailbreakMe meant that iOS users could potentially have their information stolen or unwittingly download malware by clicking on maliciously crafted PDF files.^[21] Before Apple released a fix for this security hole, jailbreak users had access to a fix published by the developer of JailbreakMe.

A 2011 study of a sample of programs available from the BigBoss repository (a default repository in Cydia) found that fewer of them leaked user data than a sample of programs available from the App Store.^[22] There are programs available via Cydia designed to add extra privacy features to iOS.^[22]

United States legal status[link]

In response to a request by the Electronic Frontier Foundation, the U.S. Copyright Office explicitly recognized an exemption to the DMCA to permit jailbreaking in order to allow iPhone owners to use their phones with applications that are not available from Apple's store, and to unlock their iPhones for use with unapproved carriers.^[23][24] Apple had previously filed comments opposing this exemption and indicated that they did consider jailbreaking to be a violation of copyright (and by implication prosecutable under the DMCA). Apple's request to define copyright law to include jailbreaking as a violation was denied as part of the 2009 DMCA rulemaking. In their ruling, the Library of Congress affirmed on July 26, 2010 that jailbreaking is exempt from DMCA rules with respect to circumventing digital locks. This exemption must be reviewed and renewed every three years or else it will expire.

Tim Wu, a professor at Columbia Law School, argued that jailbreaking is "legal, ethical, and just plain fun."^[25] Wu cited an explicit exemption issued by the Library of Congress in 2006 for personal unlocking, which notes that locks "are used by wireless carriers to limit the ability of subscribers to switch to other carriers, a business decision that has nothing whatsoever to do with the interests protected by copyright" and thus do not implicate the DMCA.^[26] Wu did not claim that this exemption applies to those who help others unlock a device or "traffic" in software to do so. As of July 26, 2010, the U.S. Copyright Office has approved exemptions to the DMCA that allow iPhone users to jailbreak their devices legally.^[27] These exemptions also allow phone users to unlock their phone in order to switch carriers. It is still possible Apple may employ technical countermeasures to prevent jailbreaking or prevent jailbroken phones from functioning, but they will not be able to sue users who jailbreak.^[28] It is also unclear whether it is legal to traffic in the tools used to make jailbreaking easy.^[28]

Types of jailbreaks[link]

An "untethered" jailbreak has the property that if the user turns the device off and back on, the device will start up completely, and it will have a patched kernel — in other words, it will be jailbroken after each reboot.^[29]

With a "tethered" jailbreak, if the device starts back up on its own, it will no longer have a patched kernel, and it may get stuck in a partially started state; in order for it to start completely and with a patched kernel, the user has to start it with the help of the jailbreaking tool.^[30]

A device with a tethered jailbreak may be able to have a "semi-tethered" solution, which means that when the device starts up on its own, it will no longer have a patched kernel (so it won't be able to run most modified code), but it will still be usable for normal functions.^[31] With a semi-tethered solution, the user can also choose to start the device with the help of the jailbreaking tool in order for it to start with a patched kernel (jailbroken).

History of iOS jailbreaking tools[link]

A few days after the original iPhone became available in July 2007, developers released the first jailbreaking tool for it,^[32] and soon a jailbreak-only game app became available.^[33] In October 2007, JailbreakMe 1.0 (also called "AppSnapp") allowed people to jailbreak iPhone OS 1.1.1 on both the iPhone and iPod touch,^[34][35] and it included Installer.app as a way to get software for the jailbroken device.

The iPhone Dev Team has released a series of free desktop-based jailbreaking tools. They released a version of PwnageTool in July 2008 to jailbreak the new iPhone 3G on iOS 2.0 as well as the iPod touch,^[36][37] newly including Cydia as the primary third-party installer for jailbroken software^[38] (PwnageTool continues to be updated for untethered jailbreaks of iOS versions up to 5.0.1).^[39][40] The iPhone Dev Team released QuickPWN to jailbreak iOS 2.2 on iPhone and iPod touch, also including options to enable functionality that was possible but disabled by Apple on certain devices.^[41] After Apple released iOS 3.0, the Dev Team published redsn0w as a simple jailbreaking tool usable on Mac and Windows, and also updated PwnageTool (now primarily intended for expert users making custom firmware, and only for Mac).^[42] They continue to maintain redsn0w for jailbreaking most versions of iOS 4 and iOS 5 on most devices.^[43] As of December 2011, redsn0w includes the "Corona" untether by pod2g for iOS 5.0.1 for iPhone 3GS, iPhone 4, iPad 1, and iPod touch 3rd and 4th generation.^[40]

George Hotz, who had developed the first iPhone unlock, released a jailbreaking tool for the iPhone 3GS on iOS 3.0 called purplera1n,^[44] and blackra1n for iOS version 3.1.2 on the iPod touch 3rd generation and other devices.^[45] In October 2010 he released limera1n, a low-level boot ROM exploit that permanently works to jailbreak the iPhone 4 and is used as part of tools including redsn0w.^[46]

comex has released multiple jailbreaks for iOS devices, beginning in May 2010 with the Spirit jailbreak for iOS version 3.1.2 on devices including the iPad for the first time.^[47] In August 2010, comex released JailbreakMe 2.0, a web-based tool that was the first to jailbreak the iPhone 4 (on iOS 4.0.1).^[48][49] In July 2011, comex released JailbreakMe 3.0, a web-based tool for jailbreaking all devices on certain versions of iOS 4.3, including the iPad 2 for the first time (on iOS 4.3.3).^[50] JailbreakMe 3.0 uses a flaw in PDF file rendering in Mobile Safari.^[51][52] He was hired by Apple as an intern in August 2011.^[53]

Chronic Dev Team initially released greenpois0n in October 2010, a desktop-based tool for jailbreaking iOS 4.1^[54] and later iOS 4.2.1^[55] on most devices including the Apple TV,^[56] as well as iOS 4.2.6 on CDMA (Verizon) iPhones.^[57]

The iPhone Dev Team, Chronic Dev Team, and pod2g collaborated to release Absinthe in January 2012, a desktop-based tool to jailbreak the iPhone 4S for the first time and the iPad 2 for the second time, on iOS 5.0.1 for both devices and also iOS 5.0 for iPhone 4S.^{[29][30][58][59]}

First jailbreaks[link]

Recent releases of jailbreaking tools[link]

See also[link]

• Hacking of consumer electronics
• iOS version history
• Mobile security
• Softmod

Notes[link]

References[link]