Checkm8 creator says his iPhone exploit requires physical device access and lacks persistence after reboot, but will make jailbreaking more accessible and safer

Unpatchable vulnerability is a game-changer that even Apple will be unable to stop. — Often, when new iOS jailbreaks become public, the event is bitter-sweet.

Ars Technica 2019-09-29 Dan Goodin

Context & Ripple Effects

Two days after the researcher released code for what he called a permanent unpatchable bootrom exploit covering A5-to-A11 iPhones from the 4S to the X, he is now clarifying its real-world limits: checkm8 needs the device connected to a computer, and it does not survive a reboot. That framing matters because the flaw lives in read-only bootrom silicon, so no iOS update can close it on already-shipped hardware.

The clarification also positions the exploit against a decade-long backdrop in which jailbreaking shrank from a mass phenomenon into an individual pursuit as Apple closed each hole. A permanently open boot door flips that cat-and-mouse dynamic, and the creator argues it makes jailbreaking more accessible and safer for the people who use it.

First-order effects

Owners of iPhone 4S through X models can now jailbreak without waiting for a team to crack each new iOS version — but only with the phone physically attached to a computer, and the modification vanishes on every reboot unless re-applied.
Apple faces a class of devices it cannot patch by design: any mitigation has to come outside the bootrom, since the vulnerable code is burned into silicon.

Second-order effects

Security researchers gain a stable, always-available research platform on older iPhones, which historically depended on whatever bug Apple had not yet fixed.
The same bootrom weakness does not stop at phones: researchers later showed a checkm8 variant hitting Macs with T2 security chips, extending the exposure across Apple's hardware line.

Third-order effects

When a vulnerability sits in immutable firmware, the industry's usual patch cadence stops working, and protection shifts to physical-access controls and eventual hardware replacement rather than software updates.
If unpatchable-but-bounded exploits like this become the norm, jailbreaking may re-emerge as a lower-risk, tool-assisted practice — while Apple's control over what runs on its devices rests increasingly on default settings rather than technical locks.

The trend: Mobile security is shifting from per-version software cat-and-mouse toward hardware trust boundaries, where flaws burned into silicon stay open for a device's entire life and shape what owners can do with hardware they have bought.

Discussion

@emsi_kil3r Emsi on x
“You don't have to stay on an older version that has security vulnerabilities just so you can jailbreak, and you won't have to wait until a jailbreak is available. This is going to make jailbreaking a lot more accessible and a lot safer for everyone” https://arstechnica.com/...
@dinodaizovi Dino A. Dai Zovi on x
This @arstechnica article has a great interview with @axi0mX on the ramifications of their BootROM exploit: https://arstechnica.com/... Spoiler: it's awesome work, but not as scary as most may think (because of the Secure Enclave and persistence is still hard, etc.)
@axi0mx @axi0mx on x
EPIC JAILBREAK: Introducing checkm8 (read “checkmate"), a permanent unpatchable bootrom exploit for hundreds of millions of iOS devices. Most generations of iPhones and iPads are vulnerable: from iPhone 4S (A5 chip) to iPhone 8 and iPhone X (A11 chip). https://github.com/...
@martijn_grooten Martijn Grooten on x
I'm with Eva here and to the various people pointing out you need physical access to jailbreak an iPhone: this is the stalkerware threat model. https://twitter.com/...
@joebeone Joseph Lorenzo Hall, PhD on x
“We strongly urge all journalists, activists, and politicians to upgrade to an iPhone that was released in the past two years with an A12 or higher CPU.” https://blog.trailofbits.com/ ...
@albertwenger Albert Wenger on x
If there is indeed an unpatchable jailbreak I may actually buy a used iPhone X https://twitter.com/...
@kennwhite Kenn White on x
Nice scoop — @dangoodin001 interviews @axi0mX and gets all the details on the new iOS bootrom exploit. https://arstechnica.com/...
@dangoodin001 Dan Goodin on x
The jailbreaking exploit released Friday prompted lots of security concerns. But it turns out it's not remotely exploitable, doesn't have persistence, and can't bypass the Secure Enclave. That's not to say Checkm8 isn't impressive and important. Read on for why. https://twitter.c…
@dguido Dan Guido on x
Read our comprehensive explainer on the new iOS Boot ROM exploit. https://twitter.com/...
@evacide Eva on x
I support people's right to jailbreak their phones. But I'm also bracing myself for the coming upgrades to the capabilities of iOS spouseware and stalkerware. https://twitter.com/...
@morpheus______ @morpheus______ on x
Non techie version: Any iPhone 8/X or earlier can now be: - booted to any iOS version, past/present/future, with no SHSH/APTickets - booted to any OS (e.g. Android) - compromised by attacker w/physical access, but still requires password (or brute force)for private data
@strangepartscom Strange Parts on x
This is a HUGE deal. Both for the security of iOS devices, but also for the ability for non-apple employees to modify iPhones and conduct security research. It's also unfixable by Apple for all iPhones up to the iPhone X (any device with an A11 or earlier). https://twitter.com/..…
@thomasareed Thomas Reed on x
If you haven't heard yet, an exploit was dropped on Twitter this morning capable of modifying the bootrom on nearly all iOS devices except the most recent. Learn about the possible implications here: https://blog.malwarebytes.com/ ...
@queercommunist @queercommunist on x
“And since it's ROM (read-only memory), it can't be overwritten or patched by Apple through a software update, so it's here to stay. It's the first bootrom-level exploit publicly released for an iOS device since the iPhone 4, which was released almost a decade ago.” https://twitt…
@dsilverman Dwight Silverman on x
As well as iPads, iPods, Apple Watches and Apple TVs. BUT ... the hacker needs to have physical access to the device. It's not a remote vulnerability. https://twitter.com/...
@andreabarisani Andrea Barisani on x
What was I saying recently about unpatchable bootrom exploits? We find them constantly in automotive grade SoCs. Consumer products have even larger attack surface... Future hacks will more and more target the code embedded in the silicon. https://twitter.com/...
@dangoodin001 Dan Goodin on x
Good writeup for anyone trying to understand the security consequences of the Checkm8 exploit. https://twitter.com/...
@ihackbanme @ihackbanme on x
and... the sandbox is now (mostly) free. #StillWIP #ToBeContinued #FreeTheSandbox https://twitter.com/...
@icj_ Callum Jones on x
Congratulations. An incredible achievement. https://twitter.com/...
@_klutchkyle_ Kyle on x
Huge thanks to @axi0mX. These exploits are worth a fortune and to see @axi0mX share it for free is unbelievable. https://twitter.com/...
@dinodaizovi Dino A. Dai Zovi on x
Holy ... I didn't think that we'd see another of these... https://twitter.com/...
@mcgrewsecurity Wesley McGrew on x
If you open your window, you can hear the parties at Cellebrite and XRY from your office https://twitter.com/...
@evanderburg Eric Vanderburg on x
Checkm8: unpatchable iOS exploit could lead to permanent jailbreak for iOS devices running A5 to A11 chips http://i.securitythinkingcap.com/ RF1gS2
@campuscodi Catalin Cimpanu on x
NEW: New Checkm8 jailbreak released for all iOS devices running A5 to A11 chips -works on iPhones 4S up to iPhone 8 and X -doesn't support A12 and A13 chipsets -code available on GitHub -uses “a permanent unpatchable Bootrom exploit” https://www.zdnet.com/... https://twitter.com/…

Chronicles