alt Hacker NewsToday, we hacked what we'd set out to hack: the iPhone
Comments
Very cool demos, but now I'm interested to know: does enabling Lockdown mode help at all against these exploits? It'll theoretically protect against a lot of common attack vectors, but I'm curious about its real-life effectiveness.
What's with iOS and pdfs pwning them? Reminds me of the ForcedEntry in Pegasus.
https://projectzero.google/2022/03/forcedentry-sandbox-escap...
https://www.trendmicro.com/en_gb/research/21/i/analyzing-peg...
the videos just don't hit the same without the dancing anime girl and the electronic dance music.
#3 is so nice, I want root access to my phone. Does anyone know if doing this can lock Apple out from updating/removing it?
This brings back lots of memory of jail-breaking iPhone era and cydia the alternative jailbroken iPhone app store.
The second video, the person who's shooting the video has his face mirrored onto the screen, anonymity is gone.
Noob q: Does this(and most) hacks like this on the iphone likely rely on some kernel module — or what it talks to for executing code — being compromised to run arbitrary code execution? I dunno about ios but it seems from the videos that something that reads imessage attachments was compromised for privilege escalation.
Like what im mean is an attack vector shaped similar to https://pepsipu.com/blog/2026-10-switch2-jailbreak-ns2jb/ i.e. they compromised `fs` module that did not protect against a buffer attack(in memmov)? My understanding is that most core kernel modules are difficult to attack directly because of XOM, PAC and CFI like protections make it impossible for anyone/thing, so most likely only indirect attacks like above can work in such situations — there is a lot of incentive for teams like apple to do everything possible to improve security so i assume only these kind of difficult to find vectors remain.
Man, sucks to see these "hacked" iPhones doing so many cooler things than my Apple-approved one.
Hoping more "unsupported" older "iDevices" can be made usable with newer software with something like "jailbreaking"
Is it an exploit around the library that handles PDF parsing/opening? Can someone explain how files / attachement are open on a mobile device ( android/iPhone).
I don't understand how in 2026 this is still a thing, we have many safe languages to parse/deserialize data. Why is it complicated?
Video 3 get a root shell agains 27.0.1 which is the latest iOS version installed on my lovely se3.
This really blown my mind, and seem the 1/2 video is installed a app by click pdf link?
I guess and hope there will be update from apple quickly
Just let me know when I can install an alternate OS to my junk drawer of 6-10 year old iPhones. That's the holy grail.
Same guys who found the PHP.
Edit: hahaha you guys are funny. “The php hack” is what I meant!
This made me miss Cydia and the old jailbreaking days so much. Was such an exciting time to have an iPhone with the tinkering. Anyone still remember iDitDahText https://iditdahtext.com/iDitDahText.html?
A reminder for people who don't follow this, Calif is Thai Duong's firm. Thai discovered the BEAST and CRIME TLS attacks (with Juliano Rizzo), and then worked at Google for a bunch of years, including on Wycheproof with Daniel Bleichenbacher. The team at Calif includes lcamtuf, Dion Blazakis, Tavis Ormandy, and Stefan Esser (among many others).
They're basically the most interesting team working in vulnerability research right now; a cross product of ludicrous talent and full-tilt AI work.
Just before I left Fly.io a few months ago, we retained Calif for an annual pentest (we'd previously worked with Tetrel, Atredis, Doyen, and I think Include?). They were spooky good. Everybody we'd worked with was good, but Calif's results were unusually high-impact.
I love these people and everything they're doing.
They are going to run out of vulns eventually when the code is rewritten in memory safe lang & the rest are found.
It would make me so happy if this would allow running UTM.app with Hypervisor support on iPadOS. I don't want to travel with two devices, the would be enough, but sometimes I need a real desktop. Apple, of course, wants you to buy two devices. I do have UTM with Jit Linux running on my iPad, via altstore and entitlements and so on, but it is all a bit complex and still fairly slow.
Man... PDF is such an unfortunate file format.
I'm not sure if this is real, but if it is: this week is unbelievable. I really hope it's not the new normal, but unfortunately I don't believe this myself.
Oh boy, what a week. Must be great working in cybersec right now.
why do we see pdf viewer exploits on ios when we have sandboxing mechanisms nowadays like wasm? Or is this exploit accounting for the sandbox breakage?
#4 is very interesting. Truly untethered (persistent) jailbreaks haven't been a thing for 10 years.
I'm tired, boss
How did they bypass MTE? Wasn't it suppose to make such exploits basically impossible?
Someone correct me please if I’m wrong but is this because iOS doesn’t sandbox their processes? I think I read Safari in particular doesn’t, but wonder if this is system-wide issue.
The more of this stuff we see, the more people will start using GrapheneOS, I guess.
Also wonder why they choose to publish and not cash-in the Apple bounty..
so i see we're still going with the apocalypse today too
Ok so you became "root", but who knows, Apple might have "superroot" and if that is not enough "god-mode".
Stay on 27.0 or upgrade to 27.0.1?
guess who put themselves on the must-hack list of every single national intelligence agency
Apple doesn't use AI to vibecode and/or pentest their software?
I think we have a right to know.
Right that does it. I'm fucking off to the pub and drinking myself under the table after this week.
Slightly offtopic but I find it slightly funny that they have accomplished to hack the iPhone yet the name of the third video is: Can you iPhone do this?
I would like to think that they might've created the video so fast and perhaps out of so excitement that the name of the title had the typo :-D
Eli5 the iMessage video? They open a file that calls their webapp?
Bro rewrite IOS in Rust :)
Oct 16th post;
More recently: iPhone Duo Jailbreak vid https://x.com/calif_io/status/2113570095549337977 (https://news.ycombinator.com/item?id=50206680)
Too bad this will be patched instead of allowing the device owner to control their own device.
Of course it's better that they found that before some shady mercenary spyware company, but I'd also want to control my ios device the same way they did in the video, but no, that's not for us.
I think we will probably see more and more restrictions on frontier models in the coming months. This is not what behemoths like Apple and Sony want to see.
Paradoxically, people are happier to buy things that they have control over, but boy, Apple loves to control every layer of consumerism.
My dream is to release an iOS app that self-installs and not say anything special about it other than having a "Download for iPhone" button on my website. If someone asked me, I'd answer: "Huh, what do you mean? It's our app for the iPhone."
Curious to see how many tokens was spent
It’s a pity we gave in to the “ecosystem” play by these huge companies.. even if I jailbreak my iOS and never let it update.. Apple can easily detect the jailbreak and lock me out of anything iCloud, and iMessage and such. iPhone would be one glorious iPod touch after that.. :-(
Seeing all these gives me the same energy of early days of jailbroken Android phones where one could become root and do whatever with the hardware… I stopped considering such tinkering because I got tired of finding those little tweaks and fixes on forums like xda every time something was updated. With the LLMs capable of automating that tool, I might find those old school way of mobile phones again…