Dream Team Explains How Corona Jailbreak Worked

Posted May 25, 2012 at 11:55am by iClarified | Please help us and submit a translation by clicking here | 18535 views

The 'dream team' of iOS hackers explains how the Corona jailbreak worked at HITBSecConf.

-
GreenPois0n Absinthe was built upon @pod2g's Corona untether jailbreak to create the first public jailbreak for the iPhone 4S and iPad 2 on for the 5.0.1 firmware. In this paper, we present a chain of multiple exploits to accomplish sandbox breakout, kernel unsigned code injection and execution that result in a fully-featured and untethered jailbreak.

Corona is an acronym for "racoon", which is the primary victim for this attack. A format string vulnerability was located in racoon's error handling routines, allowing the researchers to write arbitrary data to racoon's stack, one byte at a time, if they can control racoon's configuration file. Using this technique researchers were able to build a ROP payload on racoon's stack to mount a rogue HFS volume that injects code at the kernel level and patch its code-signing routines.

The original Corona untether exploit made use of the LimeRa1n bootrom exploit as an injection vector, to allow developers to disable ASLR and sandboxing, and call racoon with a custom configuration script. This however left it unusable for newer A5 devices like the iPad2 and iPhone 4S, which weren't exploitable to LimeRa1n, so another injection vector was needed.
-

You can get the full presentation notes from here.




Share
Add Comment
Imaster - May 25, 2012 at 6:12pm
Corona is not an acronym nor an anagram. It's a f{#^}ing corona. Cheers b}tches LOL
wherewolf - May 25, 2012 at 2:11pm
why would they explain how this works for all of apple to see making it easier to close the exploits????
Akido - May 25, 2012 at 2:20pm
As soon as a jailbreak is released, Apple devs are able to decompile the jailbreak tool to see the vulnerability it exploits so that they an close it be releasing a patch or fixing it in the new firmware. It's not difficult for them.
AJ - May 25, 2012 at 12:28pm
Corona is -not- an acronym for "racoon." Acronym- A word formed from the initial letters of other words (e.g., radar, laser, scuba). You mean... Anagram- A word, phrase, or name formed by rearranging the letters of another (e.g. cinema, formed from iceman). I know. Stickler. But we learned something here. ;-) Otherwise, a well written and informative article.
datumax - May 25, 2012 at 12:22pm
"Corona is an acronym for "racoon"" "Corona" is an ANAGRAM of "racoon." Regardless, they're all still smart in my book.
FARPThor - May 25, 2012 at 1:59pm
I guess it feels good to know such smart people ain't that smart in ALL areas!
Follow iClarified
Black Market Takes Over the iPhone 6 Lines [Video]
Filmmaker Casey Neistat has posted a new vide...
iPhone 6 Slow Motion Wine Pour at 240fps [Video]
Check out this slow motion wine pour test of ...
Verizon iPhone 6 and iPhone 6 Plus Users Get Simultaneous Voice and Data
Verizon users who have the iPhone 6 and iPhon...
Apple Lists Out-of-Warranty Prices for Replacing Screen and Battery of the iPhone 6
Alien Blue Reddit Client App Gets Redesigned Inbox/Messages, Hold to Preview, iOS 8 Support