.png)
7 months ago
67 BOOK THIS SPACE FOR AD
ARTICLE ADGreetings fellow hackers, my name is Sandy, Security Analyst and Bug bounty hunter.
As I’m presently engaged in iOS penetration testing, I’d like to relay my experiences with you, as they may prove beneficial in addressing some of the inquiries. I had difficulty getting started on resolving answers without any more introductions.
Jailbreaking, a process of removing software restrictions on iOS devices, has intrigued countless tech enthusiasts and researchers. However, it also raises security concerns for app developers and organizations keen on safeguarding their software from potential vulnerabilities. To address this, various methods have been devised to detect jailbroken devices and thwart certain apps from functioning on them. One notable approach involves harnessing Corellium, a potent mobile device emulation platform. In this blog post, we delve into how Corellium can be utilized to circumvent jailbreak detection mechanisms and delve into the ramifications it entails.
Table of contents:
Understanding Jailbreak DetectionThings to Consider Before Embarking on JailbreakingWhy Opt for Jailbreaking?Benefits of JailbreakingTypes of JailbreakIntroducing CorelliumBreaking Jailbreak Detection with CorelliumSetup a Corellium Instance and Install IPAProxy Setup for traffic Analysis with CorelliumBypassing jailbreak detection using LibertyConclusionUnderstanding Jailbreak Detection:
Before delving into specifics, let’s briefly discuss jailbreak detection. Many mobile apps use jailbreak detection methods to check if a user’s device has been jailbroken.These mechanisms typically scrutinize for telltale signs indicating a compromised device, such as specific files’ presence or system modifications. Upon detecting a jailbreak, the app might refuse to operate or curtail its functionality to mitigate potential security risks.
Things to Consider Before Embarking on Jailbreaking:
Jailbreaking bears resemblance to the rooting process in Android, wherein we unlock root permissions for Android devices, enabling alterations to system configuration files. Similarly, in iOS, this process, known as “Jailbreak,” grants access to root permissions, empowering users to leverage the device’s full potential and utilize tweaks inaccessible without jailbreaking.
Why Opt for Jailbreaking?
Jailbreaking facilitates the installation of tweaks via Cydia and grants users control over iPhone processes, easing testing endeavors, primarily dynamic analysis.
Benefits of Jailbreaking:
- Extracting IPA from iOS
- Accessing internal files
- Installing third-party tools
- Accessing process memory
- Performing TLS bypass
- Real-time debugging capabilities
Types of Jailbreak:
1. Untethered Jailbreak:
An untethered jailbreak allows users to permanently modify their iOS device’s software, granting them the freedom to reboot their device without needing to connect it to a computer. This type of jailbreak remains effective even after restarting the device.
2. Tethered Jailbreak:
A tethered jailbreak requires users to connect their iOS device to a computer whenever they wish to boot it up after a restart. Without this connection, the device remains in a non-functional state. Tethered jailbreaks are less convenient as they rely on external devices for functionality.
3. Semi-Tethered Jailbreak:
A semi-tethered jailbreak offers a compromise between untethered and tethered jailbreaking. Users can boot their iOS device without connecting it to a computer, but certain functionalities, such as accessing jailbroken apps, may be temporarily unavailable until the device is connected to a computer and rebooted with the assistance of jailbreak tools.
4. Semi-Untethered Jailbreak:
A semi-untethered jailbreak combines aspects of untethered and tethered jailbreaking. Users can reboot their iOS device without needing a computer, similar to untethered jailbreaks. However, certain jailbreak functionalities may be disabled after a reboot and require the device to be re-jailbroken using dedicated tools or applications.
Corellium is a cool tool made by a company called Corellium. It lets your computer pretend to be an iPhone. This means you can test iPhone apps without actually having an iPhone. It’s super useful for people who want to check how safe iPhone apps are.
Breaking Jailbreak Detection with Corellium:
Corellium is also helpful for figuring out how to trick apps that try to tell if your iPhone is hacked. Here’s how you can do it:
1. Get Corellium: First, sign up for Corellium and make a pretend iPhone on your computer.
2. Get the app: Next, put the app that checks for hacks onto your pretend iPhone.
3. Watch the app: Open the app and see what it does. Look out for any messages that say it found a hack on your phone.
4. Look inside: Take a peek at the app’s insides to see how it’s checking for hacks. You might find clues in its files and how it talks to the phone.
5. Beat the system: Now that you know how the app checks for hacks, come up with ways to fool it. You might need to change some stuff in the app or how it talks to the phone.
6. Check your work: Test your ideas on the app using Corellium. Make sure the app can’t tell if your phone is hacked anymore.
7. Share what you learned: Write down what you found out and tell others about it. Sharing helps everyone stay safe with their iPhones.
Now that we’ve opened up the app file from your iPhone, let’s make a fake iPhone and put the app on it.
Go to https://app.corellium.com/ and login into your account
Once logged in go and create a new device
Choose the device that’s almost the same as your real one, if not exactly the same. In my case I tested this flow on an iphone 11 pro .
Pick the iOS version that matches yours and make sure your device is jailbroken. In my case, I tested this on iOS 14.8.
You can name your device whatever you like and adjust advanced boot settings as needed. In my case I have selected advanced boot options and “Create Device”.
Again click on the “Create Device” option.
Please wait for a bit while your virtual device is being set up in the background. This might take some time.
Done and running!
Now, the emulated device is all set up and ready for the IPA file to be installed on it. Corellium provides an interface in the web interface to install IPA files.
First click on the OVPN FILE button under the connect tab, download the file because we will be using it on the windows.
Go to https://openvpn.net and download/install the client for Windows.Now, Double click to import OVPN.
We have VPN access into Corellium, yay!
We’re now connected to the Corellium VPN service, which means we can access our emulated device through the SSH service at the IP address 10.11.3.2.
Note : The default password is alpine
Prior to employing the ipatool for acquiring an .ipa file from the App Store, it is essential to establish an Apple ID and authenticate your device. This step is necessary to access the App Store and download the app package for analysis and testing.
Before we can use ipatool to download an .ipa file from the App Store, we need to search for the app package we want to analyze. This is done using the ipatool search command, which allows us to search for apps by name or by the developer’s name. For example, let’s say we want to download the Twitter app. Once you’ve found the desired app in the App Store using ipatool, you can use the app’s bundle ID as an identifier to download the .ipa file. The bundle ID is a unique identifier assigned to every iOS app, and it helps locate and download the app package from the App Store.
Installing IPA through Web UI, Click on “Install app”
Select the IPA file. I used DVIA-V2 to demonstrate.
We have successfully installed the DVIA-v2 IPA.
Before we integrate Burp Suite into this process, it’s worth noting that Corellium has a useful traffic viewer. In the “Network” tab, if you click on “Start Monitoring,” you can get a clear view of some of the HTTPS traffic that the app sends. at launch:
Now that we have the app installed on Burp Suite, we’ll proceed with similar steps outlined in the previous section titled “Setting up your physical iOS Device through Burp.” First off, you’ll need to install OpenVPN for Windows. Once OpenVPN is running, head to the taskbar, right-click on the OpenVPN icon, and select “Import File…”
Remember the OVPN file we downloaded earlier? Now, navigate to and import the file into OpenVPN. After that, return to the OpenVPN icon and click on “Connect.”
Once a connection is made OpenVPN should have an IP address assigned to you and you can have your emulated device interact with your Burp Suite session. In my case, the IP address assigned to me is 10.11.3.4
At this stage, the steps for setting up Burp Suite are similar to the ones mentioned earlier, namely:
1) Start Burp Suite
2) Click on the “Proxy” tab
3) Click on “Intercept is on” button
4) Click on “Options” tab
5) Under Proxy Listeners click on “10.11.3.4:8080” and click edit
6) Select the “Specific address” radio button and then click “OK.”
7) Click on “Yes” to the listen on Specific address warning dialog
8) Click on the “HTTP History” tab
9) Open the “Settings” app on your Corellium iOS device.
10) tap on “Wi-Fi”
11) Tap on the “i” button next to the “Corellium” Wi-Fi network.
12) tap on “Configure Proxy”
13) tap on “Manual”
14) tap on “Server” and enter the IP address given to you from OpenVPN, in my case this is “10.11.3.4”
15) Touch “Port,” input “8080,” and then tap “Save.”
16) Tap the home button to return to the main screen.
Proxy Setup
When you open the DVIA app, you’ll notice that all the traffic is routed through Burp Suite on your Windows machine via the VPN. Installing the SSLBypass tweak seems unnecessary for bypassing certificate pinning or installing the Burp certificate. Corellium does some magic in the background when you start the Network Monitor to handle certificate validation, making it easier for researchers to enhance visibility. However, if this doesn’t work in all cases, you can follow the SSLBypass tweak installation steps mentioned earlier and target the Corellium device IP instead of your physical device. SSLBypass should be installable on Corellium devices as well.
Sweet, Sweet Traffic
Bypassing jailbreak detection using Liberty involves installing the Liberty tweak on your jailbroken device. This tweak allows you to hide the jailbreak status from apps that check for it, enabling you to use those apps without restrictions. As I demonstrate in DVIA-v2 for Jailbreak Detection and Bypass.
After jailbreaking your device, you can follow these steps to bypass jailbreak detection using Liberty:
1. Launch Cydia on your jailbroken device.
2. Tap on the “Sources” tab at the bottom.
3. Tap on “Edit” in the top-right corner, then tap “Add” in the top-left corner.
4. Enter the following repository URL: https://ryleyangus.com/repo/
5. Tap on “Add Source” and wait for Cydia to refresh sources.
6. Once the repository is added, go to the “Search” tab and search for “Liberty Lite” or “Liberty Lite (Beta)”.
7. Tap on the tweak from the search results, then tap on “Install” and confirm to install it.
8. After the installation is complete, restart your device.
9. Once your device is restarted, launch the Liberty Lite app from your settings options..
10. In Liberty Lite, you’ll find a list of installed apps. Switch on the toggle next to the app you want to bypass jailbreak detection for.
11. Close the Liberty Lite app and launch the app you want to use without jailbreak detection.
12. You should now be able to use the app without encountering jailbreak detection issues.
— — — — — — — — — — — — — — — — —OR — — — — — — — — — — — — — — — — — — —
For manual Installation of “liberty lite”.
After taking ssh, use command:
I spent a few days scratching my head to figure all this out. This document is like my cheat sheet for the future because I know I’ll forget all these little steps. I’m happy to share it with everyone! It helps you set up an iOS testing place for people who test security and find bugs.
Libertylite: https://ryleyangus.com/repo/deb_files/com.ryleyangus.libertylite.beta_0.2.12_iphoneos-arm.deb
For personalize training Contact : sv110040@gmail.com
References:
Bengali (Bangladesh) · 
English (United States) ·