Source code was leaked online this week for the bootloader that helps launch Apple's iOS operating system on mobile devices. While the bootloader link on the code repository GitHub was quickly taken down following a copyright request from Apple, copies are continuing to float around the Internet, several sources reported.
The same code was posted four months ago on Reddit, although that link has also been taken down. The leak involves proprietary information that Apple works hard to keep secret. The source code appears to be for the iOS 9 version of iBoot, a stage 2 bootloader that verifies a device's iOS kernel and enables operation in Recovery Mode.
Some developers and other experts called the leak 'unprecedented,' and warned that the code could be used to jailbreak or hack iOS devices. However, others pointed to past, more serious leaks, such as that for Windows NT/2000, and noted that iOS researchers have already likely reverse-engineered considerable portions of Apple's code.
Source Code Appears 'Legit'
"Apple has traditionally been very reluctant to release code to the public, though it has made certain parts of iOS and MacOS open source in recent years," Motherboard noted Wednesday evening in an early report about the leak. "But it has taken particular care to keep iBoot secure and its code private; bugs in the boot process are the most valuable ones if reported to Apple through its bounty program, which values them at a max payment of $200,000."
Shortly after that article was posted, the publication updated its report to say that Apple had sent GitHub a Digital Millennium Copyright Act (DMCA) takedown notice demanding removal of the source code link. By doing so, it added, Apple "indirectly confirmed that the code was real."
Security researcher Karl Koscher noted on Twitter early this morning that, to invoke DMCA protections, Apple had to state, "under penalty of perjury, that the iBoot source code was legit."
While iOS 9 is more than two years old, it's likely some of the iBoot source code used back then is still used in iOS 11, the current version of Apple's mobile operating system, Motherboard noted.
Leaker's Identity Unknown... for Now
IT security consultant/hacker Hector Martin downplayed how much of a security risk the iBoot leak could pose for Apple and its customers.
"Come on, this is fun and all, but it's a bootloader," Martin said on Twitter this morning. "Any *serious* iOS researcher better have it fully reversed by now."
He acknowledged the leak could make it easier for hackers to find vulnerabilities in Apple's operating system, but added that the source code's age makes it likely such bugs have already been found by people trying to build iOS jailbreaks.
Martin also criticized reports calling the leak the "biggest in history," pointing to past disclosures with far wider-reaching impacts.
In 2004, for example, millions of lines of code were leaked for Microsoft's Windows NT and 2000 operating systems. Microsoft warned at the time that anyone who searching for or sharing such code was engaging in illegal activity, and sent letters to that effect to people who had downloaded the code.
The new iOS leak isn't even that new, The Register noted today, as it's been "quietly doing the rounds between security researchers and device jailbreakers on Reddit for four or so months, if not longer. Where exactly it came from, no one is sure for now."
Image credit: Apple; iStock/Artist's concept.
Posted: 2018-02-08 @ 11:08am PT
Remembering a humorous comment on a previous leak:
Can you imagine what would happen if Linux kernel were leaked?