Some says ago, the universal jailbreak for all Apple “iOS” devices was released at http://www.jailbreakme.com.
Some websites then “discussed” what made this jailbreak possible, and they suggested that Safari on Apple Devices must be running as “root”, so if you manage to exploit the browser you’ve become root on the device. Another source stated that after exploiting the browser, you additionally have to have and load a root exploit, as the browser itself isn’t running with root privileges.
As I’m kind of an apple fanboy sometimes, I wanted to see for myself what is going on on the device.
So I jailbreaked it using the universal exploit on the URL above, and using Cydia for installing non-Apple-approved apps, I installed Openssh and some “Hacker Tools” like ps and top that came in a package provided by BigBoss.
The results speak for themselves:

Clearly, Safari on my iPhone 3GS doesn’t run as user “root”, but as user “mobile” belonging to group “501″ (also called “mobile”). Every other app I tried, including “Accuweather”, Mail and others, is also using this account. Only Cydia is running as root, which is obviously necessary to install additional apps in the system.
So if you every read somewhere again that Apple failed here because they have all apps running as “root”, direct them to this little post.
Disclaimer: Of course this doesn’t say anything about how the actual exploit used at jailbreakme.com is working. There might be some vulnerability in Safari that helps becoming root once Safari itself is exploited, but finding the details here is left to more sophisticated engineers 
Posted by: marek
No Comments yet...
Categories: