HN

Need help?
<- Back
Today, we hacked what we'd set out to hack: the iPhone

Today, we hacked what we'd set out to hack: the iPhone

pavel_lishin

Comments (344)

  • reacharavindh
    It’s a pity we gave in to the “ecosystem” play by these huge companies.. even if I jailbreak my iOS and never let it update.. Apple can easily detect the jailbreak and lock me out of anything iCloud, and iMessage and such. iPhone would be one glorious iPod touch after that.. :-(Seeing all these gives me the same energy of early days of jailbroken Android phones where one could become root and do whatever with the hardware… I stopped considering such tinkering because I got tired of finding those little tweaks and fixes on forums like xda every time something was updated. With the LLMs capable of automating that tool, I might find those old school way of mobile phones again…
  • john_strinlai
    the videos just don't hit the same without the dancing anime girl and the electronic dance music.
  • jeroenhd
    Very cool demos, but now I'm interested to know: does enabling Lockdown mode help at all against these exploits? It'll theoretically protect against a lot of common attack vectors, but I'm curious about its real-life effectiveness.
  • aemoron
  • slowin
    #3 is so nice, I want root access to my phone. Does anyone know if doing this can lock Apple out from updating/removing it?
  • MarkusWandel
    Anything you can find with an LLM to break into a locked device/ecosystem, the operators of that ecosystem can find with an LLM too, and fix it. Right?
  • paxy
    Man, sucks to see these "hacked" iPhones doing so many cooler things than my Apple-approved one.
  • erelong
    Hoping more "unsupported" older "iDevices" can be made usable with newer software with something like "jailbreaking"
  • ghm2180
    Noob q: Does this(and most) hacks like this on the iphone likely rely on some kernel module — or what it talks to for executing code — being compromised to run arbitrary code execution? I dunno about ios but it seems from the videos that something that reads imessage attachments was compromised for privilege escalation.Like what im mean is an attack vector shaped similar to https://pepsipu.com/blog/2026-10-switch2-jailbreak-ns2jb/ i.e. they compromised `fs` module that did not protect against a buffer attack(in memmov)? My understanding is that most core kernel modules are difficult to attack directly because of XOM, PAC and CFI like protections make it impossible for anyone/thing, so most likely only indirect attacks like above can work in such situations — there is a lot of incentive for teams like apple to do everything possible to improve security so i assume only these kind of difficult to find vectors remain.
  • arjie
    Same guys who found the PHP.Edit: hahaha you guys are funny. “The php hack” is what I meant!
  • tptacek
    A reminder for people who don't follow this, Calif is Thai Duong's firm. Thai discovered the BEAST and CRIME TLS attacks (with Juliano Rizzo), and then worked at Google for a bunch of years, including on Wycheproof with Daniel Bleichenbacher. The team at Calif includes lcamtuf, Dion Blazakis, Tavis Ormandy, and Stefan Esser (among many others).They're basically the most interesting team working in vulnerability research right now; a cross product of ludicrous talent and full-tilt AI work.Just before I left Fly.io a few months ago, we retained Calif for an annual pentest (we'd previously worked with Tetrel, Atredis, Doyen, and I think Include?). They were spooky good. Everybody we'd worked with was good, but Calif's results were unusually high-impact.I love these people and everything they're doing.
  • mintflow
    Video 3 get a root shell agains 27.0.1 which is the latest iOS version installed on my lovely se3.This really blown my mind, and seem the 1/2 video is installed a app by click pdf link?I guess and hope there will be update from apple quickly
  • Thaxll
    Is it an exploit around the library that handles PDF parsing/opening? Can someone explain how files / attachement are open on a mobile device ( android/iPhone).I don't understand how in 2026 this is still a thing, we have many safe languages to parse/deserialize data. Why is it complicated?
  • rzimring
    This post gave me flashbacks to jailbreak era w/ Cydia. It's interesting to think that a lot of the those old plugins and tweaks have basically become standard supported features of the iOS now (SBSettings, Activator, WinterBoard, Zephyr, ...).
  • sgjohnson
    Oh boy, what a week. Must be great working in cybersec right now.
  • devy
    This brings back lots of memory of jail-breaking iPhone era and cydia the alternative jailbroken iPhone app store.The second video, the person who's shooting the video has his face mirrored onto the screen, anonymity is gone.
  • anon
    undefined
  • MYEUHD
  • terhechte
    It would make me so happy if this would allow running UTM.app with Hypervisor support on iPadOS. I don't want to travel with two devices, the would be enough, but sometimes I need a real desktop. Apple, of course, wants you to buy two devices. I do have UTM with Jit Linux running on my iPad, via altstore and entitlements and so on, but it is all a bit complex and still fairly slow.
  • suralind
    I'm not sure if this is real, but if it is: this week is unbelievable. I really hope it's not the new normal, but unfortunately I don't believe this myself.
  • asadm
    I want to boot linux in a vm at full-speed. is that too much to ask?
  • post_break
    Please let this be real. I need my 17 Pro to be jailbroken. I may keep my 13 Mini if it works for it too. This will be bliss.
  • anon
    undefined
  • 1970-01-01
    Just let me know when I can install an alternate OS to my junk drawer of 6-10 year old iPhones. That's the holy grail.
  • keel-control
    They are going to run out of vulns eventually when the code is rewritten in memory safe lang & the rest are found.
  • nsxwolf
    What are these videos actually demonstrating?
  • sgjohnson
    #4 is very interesting. Truly untethered (persistent) jailbreaks haven't been a thing for 10 years.
  • cardboard9926
    How did they bypass MTE? Wasn't it suppose to make such exploits basically impossible?
  • SoKamil
    Stay on 27.0 or upgrade to 27.0.1?
  • cromka
    Someone correct me please if I’m wrong but is this because iOS doesn’t sandbox their processes? I think I read Safari in particular doesn’t, but wonder if this is system-wide issue.The more of this stuff we see, the more people will start using GrapheneOS, I guess.Also wonder why they choose to publish and not cash-in the Apple bounty..
  • NamlchakKhandro
    In this thread. Apple Acolytes Anonymous.Seriously, California has a cathedral problem, may the vault dweller succeed.
  • dangoodmanUT
    so i see we're still going with the apocalypse today too
  • smasher164
    why do we see pdf viewer exploits on ios when we have sandboxing mechanisms nowadays like wasm? Or is this exploit accounting for the sandbox breakage?
  • eqmvii
    I'm tired, boss
  • headz
    No anime girl videos. Progress!
  • bcvvvy
    Right that does it. I'm fucking off to the pub and drinking myself under the table after this week.
  • amelius
    Ok so you became "root", but who knows, Apple might have "superroot" and if that is not enough "god-mode".
  • baq
    guess who put themselves on the must-hack list of every single national intelligence agency
  • v3ai
    BASED
  • amelius
    Apple doesn't use AI to vibecode and/or pentest their software?I think we have a right to know.
  • ChrisArchitect
  • blondie9x
    This made me miss Cydia and the old jailbreaking days so much. Was such an exciting time to have an iPhone with the tinkering. Anyone still remember iDitDahText https://iditdahtext.com/iDitDahText.html?
  • artursapek
    Man... PDF is such an unfortunate file format.
  • Imustaskforhelp
    Slightly offtopic but I find it slightly funny that they have accomplished to hack the iPhone yet the name of the third video is: Can you iPhone do this?I would like to think that they might've created the video so fast and perhaps out of so excitement that the name of the title had the typo :-D
  • zb3
    Too bad this will be patched instead of allowing the device owner to control their own device.Of course it's better that they found that before some shady mercenary spyware company, but I'd also want to control my ios device the same way they did in the video, but no, that's not for us.
  • anon
    undefined
  • aftbit
    Now - does the Signal 1-click work on Graphene?
  • nalekberov
    I think we will probably see more and more restrictions on frontier models in the coming months. This is not what behemoths like Apple and Sony want to see.Paradoxically, people are happier to buy things that they have control over, but boy, Apple loves to control every layer of consumerism.
  • CH-Abhinav
    Bro rewrite IOS in Rust :)
  • jonathanstrange
    My dream is to release an iOS app that self-installs and not say anything special about it other than having a "Download for iPhone" button on my website. If someone asked me, I'd answer: "Huh, what do you mean? It's our app for the iPhone."
  • whynotmaybe
    Eli5 the iMessage video? They open a file that calls their webapp?
  • ValtteriL
    Curious to see how many tokens was spent
  • Foxhuls
    I guess I've never really understood why people who don't like the way the iPhone and apple ecosystem work buy apple products. There are plenty of other options out there. Every time articles about this and the App Store pop up it seems as if the comments are filled with a whole lot of android users that are upset that iPhone's aren't like androids. That's not to say those are all of the comments and there aren't clearly iPhone users who want these options but again, why buy a product that doesn't support these things if they're so important to you in the first place.