Chinese Hacker Publishes PoC for Remote iOS 12 Jailbreak On iPhone X

A Chinese cybersecurity researcher has today revealed technical
details of critical vulnerabilities in Apple Safari web browser and
iOS that could allow a remote attacker to jailbreak and compromise
victims’ iPhoneX running iOS 12.1.2 and before versions.

To do so, all an attacker needs to do is trick iPhoneX users
into opening a specially crafted web page using Safari browser,
that’s it.

However, finding flaws and creating a working exploit to carry out
such attacks is not as easy as it may sound for every iOS hacker.

Discovered by security researcher Qixun Zhao^[1] of Qihoo 360’s Vulcan
Team, the exploit takes advantage of two security vulnerabilities
that were first demonstrated at TianfuCup^[2] hacking contest held in
November last year and then was later responsibly reported to the
Apple security team.

Zhao today released some details of and a proof-of-concept video
demonstration for his exploit, which he dubbed “Chaos,”
after Apple just yesterday released iOS version 12.1.3 to
patch the issues.
^[3][4]

According to the researcher, the remote Jailbreak exploit is a
combination of two vulnerabilities, i.e., a type confusion memory
corruption flaw (CVE-2019-6227) in Apple’s Safari WebKit and a
use-after-free memory corruption issue (CVE-2019-6225) in iOS
Kernel.

As shown in the video demonstration of the Chaos iPhone X
jailbreak exploit, the Safari flaw allowed maliciously crafted web
content to execute arbitrary code on the targeted device, which
then used the second bug to elevate privileges and install a
malicious application silently.

However, the researcher has chosen not to publish the code for iOS
jailbreak in an attempt to prevent malicious attacks against Apple
users and hopes that the jailbreak community would use this
information to soon come up with a suitable jailbreak exploit for
users.