Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 3 down vote favorite

How can I find out if my iPhone (or iPad) has been jailbreaked (with a drive-by injection for example)? Is there an app for that?

share|improve this question
2  
I don't think a driveby jailbreak even exists. There were jailbreaks that you could initiate in Safari for certain versions of iOS, but as far a I know nothing like that was ever exploited for nefarious purposes. What version of iOS are you running? – Chris Herbert Nov 6 '12 at 19:59
1  
It's a reasonable question in the case where the users phone was out of their control for a little while. I imagine it would also be useful for people who arrive at this page suspious that a jelous other half has installed some stealth tracking app – Joe Dec 7 '12 at 8:34

3 Answers

up vote 1 down vote accepted

It can be difficult it if was done stealthily (for example - it's fairly easy to hide things like Cydia) - my approach would be to see if iBooks or Skype work - iBooks has historically been broken by jailbreaks and Skype is designed to prevent use on a jailbroken device (which is annoying if you want to use skype, but excellent if you want to know if you are on a jailbroken device).

share|improve this answer
Skype works just fine on JB devices (for years now) and iBooks is no longer an issue either. Your suggestions are sorely outdated and this should not have been accepted as the answer. – cksum Mar 31 at 15:49
up vote -1 down vote

A jailbreak is essentially 3 points:

  • Patching the kernel to bypass code signing enforcement
  • Making the system partition writable
  • Providing a way of actually accessing it via one of more of:
    • AFC2 server for USB access
    • SSH server for wireless or tunneled USB access
    • A file management app

To check for the presence of AFC2 it is sufficient to use a dedicated PC app such as iFunBox while checking for SSH is harder due to the ability for a dedicated individual (or software!) to change the listening port from the standard 22. And this 3rd point isn't even formally required to call it a jailbreak.

You can check for the 2nd point by checking the /etc/fstab file, and since having access to the root partition would easily demonstrate being jailbroken the only alternative would be a SSH ramdisk.

If you're really paranoid about it and don't care for some potentially wasted space if your device was indeed jailbroken, you can create a local backup via iTunes and restore the OS followed by the backup.

share|improve this answer
The last two points have nothing to do with JB'ing. SSH is not installed by default and must be done so by the user. The entire filesystem is always writeable, it's just that the root account is not made available until the JB. – cksum Mar 31 at 15:52
No. The system partition is read-only on stock iOS, and I did warn that checking for some filesystem access is not an ultimately reliable method… – Ryccardo Mar 31 at 19:32
No it is not. Root has write access to nearly all the files. You can verify this by jailbreaking and checking file permissions on any number of system files. You are completely wrong I'm afraid. This fact is actually pretty obvious as iOS has to open, write to, and execute a number of system files to function. It could not operate in a read-only environment. You are confused between the users root and mobile. – cksum Apr 1 at 5:17
Marking a filesystem as ro in /etc/fstab has priority even over "root doesn't even have to care about permissions" (of course, root can thus remount it read/write which could be possible without editing fstab by running a command on every boot, but nobody with a sane mind would do that :>) – Ryccardo Apr 1 at 9:21
up vote -2 down vote

Well if you are on iOS 6 then it is not possible, you would also have a Cydia application on your screen, like this:

enter image description here

share|improve this answer
Just so you know, iOS 6 has been Jailbroken for the A4 devices and the 3GS since day 1. – Andrew Larsson Dec 14 '12 at 20:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.