3

People always say, "Jailbreaking can cause security problems." That might be true, but in some instances, you just need to jailbreak it.

How can I protect my iPhone and my data when it is jailbroken? Is there an app (through Cydia), that allows me to modify anything, or is there no easy application that does this? I'm pretty sure jailbreaking just removes the part of the OS that only allows you to download apps from the App Store. You think you would be able to modify that file/part of the system and allow it access to Cydia or whatever, and then somehow create a secure network and screen apps for viruses or whatever.

Improve this question
5
  • 2
    Are you looking for an explanation as to how to understand what a jailbreak changes and how you would evaluate security implications of those changes? Or is this more of a request to see if someone has done a security analysis of a very specific jailbreak at a certain version of iOS on a specific device?
    – bmike ♦
    May 31, 2013 at 13:27
  • @bmike All I'm asking for is what I can do to protect myself from these loopholes.
    – Anonymous Penguin
    May 31, 2013 at 14:53
  • 1
    The thing I'd do is re-enable the code signing restriction and sandbox requirements and turn off all remote access, disable all root accounts, choose secure passwords for all accounts that your specific jailbreak process creates or modifies. Apple has teams of people to police third party apps, set up sandboxes, audit security, etc… When you jailbreak, you take responsibility for all of those activities which carries a large technical burden to know what to check in the first place and then how to secure things.
    – bmike ♦
    May 31, 2013 at 16:04
  • @bmike You realize that if you added links and that was an answer, it would be accepted right now... thanks.
    – Anonymous Penguin
    May 31, 2013 at 16:18
  • Related: What malware has actually affected Jailbroken iOS devices?
    – Andrew Larsson
    Jul 16, 2013 at 17:22

4 Answers 4

Reset to default
4

On a general level, I'd personally secure a jailbroken phone by re-enabling the code signing restrictions of iOS, ensure sandbox requirements are upheld and turn off all remote access. Furthermore, disabling all root accounts and choosing secure passwords for all remaining accounts that your specific jailbreak process creates or modifies would be prudent.

Apple has teams of people to police third party apps, set up sandboxes, audit security, etc… When you jailbreak, you take responsibility for all of those activities which carries a large technical burden to know what to check in the first place and then how to secure things.

At some point, this exercise becomes a bit metaphysical - Do you trust Apple to engineer and watch the device? Do you trust yourself to be up on securing unix systems (Practical Unix and Internet Security, 3rd Edition is a fabulous book)? Do you trust the jailbreak to document what changes it has made and allow you the control over security you desire?

There are clearly times when a jailbroken phone (in the hands of a knowledgable operator) can be more secure than Apple's current iOS if it patches a vulnerability that you need to have closed now and not when Apple patches it - but for most, sticking as close to Apple's configuration as possible is the best plan from a security stance.

Improve this answer
2

Update: I found this:

One thing you can do it change the root password of your iPhone to prevent viruses from getting in with the common password.

Improve this answer
1

Aside from changing you default passwords if you install openssh, don't install from shady repositories. Thats the only real risk I can see. Some people may try to call whatever exploit was used to allow jailbreaking a 'security issue', but often with each jailbreak there is a package you can install that closes said hole.

Improve this answer
1
  • "but often with each jailbreak there is a package you can install that closes said hole." Where would I find one of these?
    – Anonymous Penguin
    May 31, 2013 at 14:54
0

Yes, changing your root password and "mobile" password is a very good way of preventing viruses, but the way to go is not to install from repositories/sources that have a bad reputation.

What you said about "download apps" is correct. In fact, Cydia itself has root access. What it does is it downloads the ipa and installs it as a application. The app store is unaffected.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .