SECURITYWEEK NETWORK:

ICS:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

New ‘Unc0ver’ Jailbreak Uses Vulnerability That Apple Said Was Exploited

Unc0ver jailbreak exploits CVE-2021-1782

The latest version of the Unc0ver jailbreak leverages a vulnerability that Apple said had been exploited before it released a patch in January.

Unc0ver jailbreak exploits CVE-2021-1782

The latest version of the Unc0ver jailbreak leverages a vulnerability that Apple said had been exploited before it released a patch in January.

Jailbreaks remove restrictions and give users greater control over their iPhone or iPad. The developers of the jailbreak named Unc0ver recently announced the availability of version 6.0.0, which they claim works on all versions of iOS between 11.0 and 14.3 on many iPhones and iPads, including the iPhone 12 Pro launched a few months ago.

Unc0ver developers say the jailbreak is “designed to be stable” and it preserves the security layers implemented by Apple.

Unc0ver does not work on devices running iOS 14.4. That version of the operating system, released by Apple in late January, patches CVE-2021-1782, a kernel vulnerability that can be exploited for privilege escalation.

CVE-2021-1782 is one of the three vulnerabilities that Apple said “may have been actively exploited” at the time when it released the patches. All three flaws had been reported to Apple by an anonymous researcher. The tech giant has not made public any information regarding the attacks exploiting these vulnerabilities.

The developers of the Unc0ver jailbreak said on Twitter that they wrote their “own exploit based on CVE-2021-1782 for unc0ver to achieve optimal exploit speed and stability.”

Related: ‘Unpatchable’ iOS Bootrom Exploit Allows Jailbreaking of Many iPhones

Advertisement. Scroll to continue reading.

Related: Apple Patches Recent iPhone Jailbreak Zero-Day

Related: Jailbreak Tool Updated to Unlock iPhones Running iOS 13.5

Related: Apple Targets Jailbreaking in New Complaint Against Corellium

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

More from

Latest News

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Virtual Event: Threat Detection and Incident Response Summit
Wednesday, May 24, 2023

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.

Register

Virtual Event: CISO Forum Virtual Summit
June 13-14, 2023

Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.

Register

Expert Insights

Related Content

Full Disclosure List Gets a Fresh Start – Reborn Under New Operator

Vulnerabilities

Full Disclosure List Gets a Fresh Start – Reborn Under New Operator

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

March 26, 2014
ChatGPT data breach ChatGPT data breach

Data Breaches

ChatGPT Data Breach Confirmed as Security Firm Warns of Vulnerable Component Exploitation

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

March 28, 2023
Supply Chain Cybersecurity Supply Chain Cybersecurity

Risk Management

Cyber Insights 2023 | Supply Chain Security

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

February 2, 2023
Chrome 111 Update Patches High-Severity Vulnerabilities

Vulnerabilities

Chrome 111 Update Patches High-Severity Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.

March 22, 2023
Microsoft addresses Cobalt Strike abuse Microsoft addresses Cobalt Strike abuse

Vulnerabilities

Microsoft Warns of Outlook Zero-Day Exploitation, Patches 80 Security Vulns

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

March 14, 2023
New iOS exploit blamed on US intelligence New iOS exploit blamed on US intelligence

Vulnerabilities

Apple Patches Actively Exploited WebKit Zero-Day Vulnerability 

Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

February 14, 2023
16 Car Makers and Their Vehicles Hacked via Telematics, APIs, Infrastructure

IoT Security

16 Car Makers and Their Vehicles Hacked via Telematics, APIs, Infrastructure

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

January 5, 2023
Mobile Security Client Market to Hit $2.9 Billion by 2017: Report

Mobile & Wireless

Mobile Security Client Market to Hit $2.9 Billion by 2017: Report

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

April 30, 2013