Backdoor in TAIG Jailbreak 2.2!

[Twilight]

太极越狱重大安全后门
路人甲 · 2015/07/01 19:05

0x00 背景

太极越狱iOS8.1.3-8.4含有重大安全后门，越狱后导致任意APP可以提权到Root，从而影响用户数据的安全。举例来说获取Root权限后可以完全控制系统文件，甚至进一步安装木马等严重威胁用户安全的恶意软件。
0x01 细节

具体分析结果显示太极越狱修改了setreuid这个关键系统API，导致任意APP都可以直接调用setreuid(0,0)获得Root执行权限，从而可以修改任意系统文件、也可以task_for_pid打开系统内核句柄从而完全控制系统底层。例如通过写入系统目录“/Library/LaunchDaemons”可以注册系统服务，从而植入木马、病毒、盗号工具威胁用户隐私数据和密码。

漏洞重现演示如下图：

enter image description here

示例一：通过test_taig_backdoor1程序读取内核内存

enter image description here

示例二：通过test_taig_backdoor2获得root权限shell

太极越狱iOS8.0-8.1.1未能找到机器进行测试，可能也有此重大后门。
0x02 总结

越狱软件中藏有安全后门并非没有先例。早在针对iOS 7的完美越狱工具evasi0n7中，越狱开发者evad3rs就修改了第0号系统调用，导致任意app可以轻易获得内核代码执行的能力。这一做法也引起越狱大神winocm的强烈不满(http://winocm.moe/projects/research...security/)。早在2014年Winocm在博文中就已经质疑太极是否在利用这个后门。

太极越狱与evad3rs的“绯闻”一直没有间断。据福布斯报道（http://www.forbes.com/sites/thomasb...ile.163.com/15/0630/10/ATBNV93H0011671M.html）, 太极曾支付evad3rs高达一百万美金用于越狱合作开发，该合作的产物就是evasi0n7强制安装“太极助手”的闹剧。至于太极越狱的安全后门是“惯犯”还是“初犯”的谜底恐怕就无法揭开了。

 

[audioenslave]

太极越狱重大安全后门
路人甲 · 2015/07/01 19:05

0x00 背景

太极越狱iOS8.1.3-8.4含有重大安全后门，越狱后导致任意APP可以提权到Root，从而影响用户数据的安全。举例来说获取Root权限后可以完全控制系统文件，甚至进一步安装木马等严重威胁用户安全的恶意软件。
0x01 细节

具体分析结果显示太极越狱修改了setreuid这个关键系统API，导致任意APP都可以直接调用setreuid(0,0)获得Root执行权限，从而可以修改任意系统文件、也可以task_for_pid打开系统内核句柄从而完全控制系统底层。例如通过写入系统目录“/Library/LaunchDaemons”可以注册系统服务，从而植入木马、病毒、盗号工具威胁用户隐私数据和密码。

漏洞重现演示如下图：

enter image description here

示例一：通过test_taig_backdoor1程序读取内核内存

enter image description here

示例二：通过test_taig_backdoor2获得root权限shell

太极越狱iOS8.0-8.1.1未能找到机器进行测试，可能也有此重大后门。
0x02 总结

越狱软件中藏有安全后门并非没有先例。早在针对iOS 7的完美越狱工具evasi0n7中，越狱开发者evad3rs就修改了第0号系统调用，导致任意app可以轻易获得内核代码执行的能力。这一做法也引起越狱大神winocm的强烈不满(http://winocm.moe/projects/research...security/)。早在2014年Winocm在博文中就已经质疑太极是否在利用这个后门。

太极越狱与evad3rs的“绯闻”一直没有间断。据福布斯报道（http://www.forbes.com/sites/thomasb...ile.163.com/15/0630/10/ATBNV93H0011671M.html）, 太极曾支付evad3rs高达一百万美金用于越狱合作开发，该合作的产物就是evasi0n7强制安装“太极助手”的闹剧。至于太极越狱的安全后门是“惯犯”还是“初犯”的谜底恐怕就无法揭开了。

got english translation? all chinese no head no tail what u talking abt

 

[EldonChew]

Just don't install any apps/tweaks from unknown/untrusted sources/developers and wait for an update that's coming to fix it

 

[consigliere]

TAIG version 2.2.1 out!

 

[Twilight]

TAIG version 2.2.1 out!

Dont upgrade 2.2.1!

TaiG has updated its iOS 8.4 jailbreak tool to fix a security issue, but as of now, that update is no longer available on its website or via Cydia. TaiG 2.2.2, which includes a setreuid patch to prevent applications from obtaining to root privileges through setreuid, was deemed unsafe by saurik. With this in mind, please don’t upgrade.

Here’s saurik’s comment on the release:

OK, so this is a pretty serious issue: the new patch that TaiG built just doesn’t work :/. I wish they would calm down and let me do this correctly. I’ve pulled their update.

Needless to say, the package was pulled from Cydia, and no longer shows up on TaiG’s website as well. I’m sure they are working on fixing whatever issues saurik spotted with the update.

Stay tuned, we’ll update you once a safe package reappears.

 

[Presto80]

is this affecting onli taig 2.2?

 

[consigliere]

I installed 2.2.1 already... Sad

 

[PAI KIA]

So the safe jb tool is 2.2.0 ? Once jb don't do any update ?

 

[audioenslave]

After a false start earlier this morning with an update to its iOS 8.4 http://www.redsn0w.us/2015/07/download-taig-221-ios-84-jailbreak.html#, TaiG has officially released version 2.2.1.

​

This update is security oriented, as it contains the setreuid patch to prevent applications from obtaining to root privileges through setreuid. The update also contains stability improvements. If you’ve yet to jailbreak your 8.4 device, it is recommended that you use this latest version of TaiG’s tool, version 2.2.1.

Here is the official change log for version 2.2.1:

• Fixes setreuid patch to prevent applications from obtaining to root privileges through setreuid.
• Increases stability.\

Here's the download links:

• TaiG v2.2.1: Windows only

Indeed, it’s a brief update, but definitely necessary given the security concerns. Like previous TaiG releases, this one is still Windows-only, but you can use a virtual machine to easily jailbreak your iOS 8.4 device on a Mac via a virtual machine setup.