Unpatchable Vulnerability “Checkm8” is a Game-Changer for Jailbreak Community

Categories: Blog Posted on: October 12, 2019

Last week we have seen the release of Checkm8. Unlike just about every other jailbreak exploit released in the past nine years, it targets the iOS boot-ROM, which contains the very first code that’s executed when a device is turned on. Because the boot-ROM is contained in read-only memory inside a chip, jailbreak vulnerabilities that reside there can’t be patched. An exploit is a piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug or vulnerability to cause unintended or unanticipated behavior to occur on computer software or hardware. Such behavior frequently includes things like gaining control of a computer system, allowing privilege escalation, or a denial-of-service attack.

Checkm8 was developed by a hacker who uses the handle axi0mX. He was also the developer of another 2017 jailbreak-enabling exploit called “alloc8”. Because it was the first known iOS boot-ROM exploit in many years, it was popular among researchers, but it worked only on the iPhone 3GS, which was seven years obsolete when alloc8 went public and had little practical application. Checkm8 works on 11 generations of iPhones, from the iPhone 4S to the iPhone X.

While it doesn’t work on new devices, Checkm8 can jailbreak hundreds of millions of devices in use today because the boot-ROM can’t be updated after the device has been manufactured. Checkm8 requires physical access to the phone and can’t be remotely executed, even if combined with other exploits. It allows only tethered jailbreak and must be run each time a device boots. Checkm8 doesn’t bypass the protections offered by the Secure Enclave and Touch ID. This exploit works only in memory, so it doesn’t have anything that persists after reboot. Before Apple introduced the Secure Enclave and Touch ID in 2013, you didn’t have advanced security protections. In which case, Checkm8 vulnerability would allow you to quickly get the PIN and get access to all the data. However, for most current phones, from iPhone 6 to iPhone 8, there is a Secure Enclave that protects your data if you don’t have the PIN.

This does not mean one should not worry about this latest exploit. If, for example, one leaves a phone in a hotel room, it would be possible that someone did something to the phone that causes it to send all of the information to a hacker. Although not common in nature in this scenario, it would be more likely to get one to connect to a bad Wi-Fi hotspot or visit a bad webpage. Attackers usually want to be in the distance and hidden.

Commercial companies such as Greykey or Cellebrite, on the other hand, should be fully able to take advantage of this standalone exploit. Even further, such firms, as well as adept mobile forensic examiners and security experts, can, in theory, use more than one exploit (exploit chain) to fully gain access to the phone. Checkm8 can be combined with other exploits and can serve as a step to crack the PIN code.

Some people enjoy jailbreaking as a hobby, and they do it for fun or hack it. But there is a more serious need for such an exploit. Law enforcement and computer forensic examiners alike had been restricted to gaining access to the more so hidden components of modern iOS devices; now, it’s possible to inspect what is under the hood again. Operating system files and log data, which can be crucial sources of evidence, should now be obtainable again from a phone that has been jailbroken with Checkm8.

And yes, Apple Watches series 1, 2, and 3 are also vulnerable to Checkm8. For consumers, however, at least for now, if you maintain the physical security of your iPhone, then your passcode, including your pictures and text messages, remains safe.