Field Notes

source

Developer of Checkm8 explains why iDevice jailbreak exploit is a game changer

StatusStableUpdatedStands on1 sourceSupportsnotes

Dan Goodin’s Ars Technica interview with axi0mX, published 28 September 2019, the day after checkm8’s public release. The saved copy preserves the rendered page. It is the developer’s own contemporaneous account of what checkm8 is and why he released it.

What it is evidence for

  • The discovery story: axi0mX found the SecureROM use-after-free by analyzing a patch Apple shipped in an iOS 12 beta in summer 2018 that fixed the same bug in iBoot.
  • axi0mX’s own characterization of the exploit’s limits: code execution only in memory, nothing persists past reboot, DFU mode plus a USB cable required, no effect on the Secure Enclave, and quick data access without a PIN only on pre-SEP devices like the iPhone 5 and 5c.
  • The intent behind the free release: “for the benefit of iOS jailbreak and security research community,” in contrast to the private boot-level capability forensic vendors were selling at the time.
  • The A12 boundary in the developer’s words: “There were changes to make [newer chipsets] not exploitable… Because Apple patched some bugs in the newer phones, it can no longer be exploited as far as I know.”

Limitations

The technical claims are axi0mX’s own statements reported through a journalist, not independent verification; his “as far as I know” hedges on A12 are quoted as given. The interview predates checkra1n, palera1n, and the forensic-vendor integrations, so it speaks to intent and mechanism rather than to what the exploit later became.

Placement

Primary source for checkm8; the SEP/passcode boundary it documents is also cited by Offline brute-force resistance of phone disk encryption and Mobile operating system security comparison.

Built on 1 source (1 external).

Working out connections…