Dream Team Explains How Corona Jailbreak Worked

Posted May 25, 2012 at 11:55am by iClarified | Please help us and submit a translation by clicking here | 18467 views

The 'dream team' of iOS hackers explains how the Corona jailbreak worked at HITBSecConf.

-
GreenPois0n Absinthe was built upon @pod2g's Corona untether jailbreak to create the first public jailbreak for the iPhone 4S and iPad 2 on for the 5.0.1 firmware. In this paper, we present a chain of multiple exploits to accomplish sandbox breakout, kernel unsigned code injection and execution that result in a fully-featured and untethered jailbreak.

Corona is an acronym for "racoon", which is the primary victim for this attack. A format string vulnerability was located in racoon's error handling routines, allowing the researchers to write arbitrary data to racoon's stack, one byte at a time, if they can control racoon's configuration file. Using this technique researchers were able to build a ROP payload on racoon's stack to mount a rogue HFS volume that injects code at the kernel level and patch its code-signing routines.

The original Corona untether exploit made use of the LimeRa1n bootrom exploit as an injection vector, to allow developers to disable ASLR and sandboxing, and call racoon with a custom configuration script. This however left it unusable for newer A5 devices like the iPad2 and iPhone 4S, which weren't exploitable to LimeRa1n, so another injection vector was needed.
-

You can get the full presentation notes from here.




Share
Add Comment
Imaster - May 25, 2012 at 6:12pm
Corona is not an acronym nor an anagram. It's a f{#^}ing corona. Cheers b}tches LOL
wherewolf - May 25, 2012 at 2:11pm
why would they explain how this works for all of apple to see making it easier to close the exploits????
Akido - May 25, 2012 at 2:20pm
As soon as a jailbreak is released, Apple devs are able to decompile the jailbreak tool to see the vulnerability it exploits so that they an close it be releasing a patch or fixing it in the new firmware. It's not difficult for them.
AJ - May 25, 2012 at 12:28pm
Corona is -not- an acronym for "racoon." Acronym- A word formed from the initial letters of other words (e.g., radar, laser, scuba). You mean... Anagram- A word, phrase, or name formed by rearranging the letters of another (e.g. cinema, formed from iceman). I know. Stickler. But we learned something here. ;-) Otherwise, a well written and informative article.
datumax - May 25, 2012 at 12:22pm
"Corona is an acronym for "racoon"" "Corona" is an ANAGRAM of "racoon." Regardless, they're all still smart in my book.
FARPThor - May 25, 2012 at 1:59pm
I guess it feels good to know such smart people ain't that smart in ALL areas!
Follow iClarified
Sonos Now Works on Your Existing Wi-Fi Network
Sonos has announced a major software update t...
Leaked Battery for 5.5-Inch iPhone 6 Has Nearly Twice the Capacity of Apple's iPhone 5s Battery
Sony Music Unlimited App Gets Fresh Visual Design, Ability to Edit Song Order in Playlists, More
Apple's R&D Spending Suggests Something Big is Coming [Chart]
Morgan Stanley analyst Katy Huberty has relea...
Reddit Releases Official 'Ask Me Anything' App for iPhone
Reddit has released an official 'Ask Me Anyth...