Warning: It's Possible for a Jailbreak Tweak to Permanently Brick Your iPhone

Warning: It's Possible for a Jailbreak Tweak to Permanently Brick Your iPhone

Posted by · 27505 views · Translate
The jailbreak community is at risk of malware following a release of a proof of concept that demonstrates it's possible for a tweak to permanently brick your iPhone.

Arcticsn0w announced the PoC on reddit. It was created after users who were trying to follow dayt0n's bootcolor changing method (that messes with the device's nvram) reported completely bricked devices due to a misstep in following the instructions.

I have released a very, very, very, very dangerous package as a proof of concept called "KilliOS" on my personal Cydia repository (http://arcticsn0w.github.io). It is an empty package which messes with nvram values in the postinst script, and then forces a reboot. Installing this package will instantly kill your device.

Installation of the tweak results in "instant death of your device". Something which is stressed repeatedly by acticsn0w.

"TL;DR Be very careful. Please, I swear to god, do not install KilliOS. Please. If you do, I can't help you fix your device. It's very dangerous. It is only a proof of concept saying "Tweaks CAN do this". Do not install. Do not install. Do not install. Do not install. Do not install. Do not install. Do not install. Do not install. Do not install. Do not install. Do not install."

The tweak was eventually pulled because it was so dangerous and the code has been made available in GitHub.

All of this is based on changing a nvram variable called DClr_override.

If this is changed to an invalid value for the device (valid values are not the same on all devices), and the device is rebooted, the device will permanently not be able to boot. This cannot be fixed with a DFU restore or any other method.

DClr is the variable inside of iBoot that determines what color the Apple logo should be on boot, notes dayt0n. It only exists on the iPhone 5 and up. It is composed of 32 hex characters, consisting of 16 bytes, and it determines the color of the logo until SpringBoard begins to launch.

It's pretty simple to change the DClr value but some users attempting to follow the instructions discovered that a mistake led to the bricking of their device.

Now that a very simple method for bricking devices has been made public, users are in danger of installing a malicious tweak that can kill their device.

To protect yourself we strongly suggest that you only install tweaks from respected repositories and developers. Pirated tweaks and questionable repos could put your device at risk.

Thankfully developers are working on a fix and there is already a temporary failsafe by ktechmidas that offers some protection. More details here.

Please follow iClarified on Twitter, Facebook, Google+, or RSS for updates.


Warning: It's Possible for a Jailbreak Tweak to Permanently Brick Your iPhone
markallen09089 - January 5, 2016 at 8:41am
Your way of writing is too good, definitely developed worth ideas on my mind. Cctv Dvr:https://dubaivfm.com/product/product-category/cctv-dvr
Apple tv - February 19, 2015 at 4:36pm
Well I guess Iphone is taking Samsung path. Or the guy who released the code could be Samsung guy!! Haha just kidding. Samsung had this problem long time ago, when you try to root or install wrong device firmware and bricked the phone. For those who blame the guy of releasing the code. I said good for him to let us know there is a big danger for jailbroken iPhone. So jailbreak community can try to find a solution. Or you rather he didn't released or said anything, and someone (apple cough! Don't like jailbreak) release it do bunch of jailbroken devices become bricked, so people would not jailbreak their iPhone anymore?
Slidor - February 18, 2015 at 3:01pm
Can anyone tell me why DFU mode wouldn't work in this case?
steve blows - February 18, 2015 at 3:53pm
Well because the way DFU mode works is kinda like a stripped down version of regular mode. There's two partitions in the iphone, one is 16gb or 8gb or 32gb or 64gb or 128gb depending on what the phone is, and the second partition is like 200mb or something small. This second partion is the DFU partition that's only instructions is to boot into recovery mode using the same instruction set from the NVRam as the regular mode. This DFU partition doesn't have the support to display anything on the screen or access the GPS or WIFI or camera or anything like that. Just boot into recovery mode and be able to access the Primary partition to completely erase it and do a complete iOS restore. Now when it's booting up into recovery mode, it still accesses the NVram to call up some commands that this tweak alters and breaks the phone from booting up.
Slidor - February 18, 2015 at 6:32pm
Ok, thanks a lot
29 More Comments
Recent