Misplaced Pages

SHSH blob: Difference between revisions

Article snapshot taken from Wikipedia with creative commons attribution-sharealike license. Give it a read and then ask your questions in the chat. We can research this topic together.
Browse history interactively← Previous editNext edit →Content deleted Content addedVisualWikitext
Revision as of 00:13, 10 January 2013 editCantaloupe2 (talk | contribs)5,132 edits →Technical details: we're not certain of this grad student is a reliably published expert on this subject to have exemption from WP:SPS policy← Previous edit Revision as of 00:16, 10 January 2013 edit undoCantaloupe2 (talk | contribs)5,132 edits →Technical details: WP:RS, no i think not. about author; "Sayam Aggarwal is a 18-year-old student living in India who has been an Apple fan for almost 5 years."Next edit →
Line 7: Line 7:
SHSH blobs are created by a ] that has multiple keys, including the device type, the iOS version being signed, and the device's ECID (a unique identification number embedded in its hardware).<ref name="stefanesser">{{cite web |url= http://antid0te.com/CSW2012_StefanEsser_iOS5_An_Exploitation_Nightmare_FINAL.pdf |title= iOS 5: An Exploitation Nightmare? |author= Stefan Esser |date= March 2012 |work= |publisher= CanSecWest Vancouver |accessdate=3 December 2012}}{{dubious|date=January 2013}}</ref> When Apple wishes to restrict users' ability to restore their devices to a particular iOS version, Apple can refuse to generate this hash during the restore attempt, and the restore will not be successful (or at least will require bypassing the intended function of the system).<ref>{{cite web |url= http://lifehacker.com/5795242/save-your-idevices-shsh-to-avoid-losing-the-ability-to-jailbreak-your-idevice |title= Save Your iDevice’s SHSH to Avoid Losing the Ability to Jailbreak |author= Adam Dachis |date= April 25, 2011 |work= |publisher= Lifehacker |accessdate=August 2, 2011}}</ref><ref>{{cite web |url= http://www.techrepublic.com/blog/mac/apple-ios-6-woes-save-the-blobs-if-you-need-to-downgrade/2340 |title= Apple iOS 6 woes: Save the blobs if you need to downgrade |last1= Smith |first1= Gina |last2= |first2= |date= September 27, 2012 |work= Apple in the Enterprise |publisher= TechRepublic |accessdate=December 30, 2012}}</ref> SHSH blobs are created by a ] that has multiple keys, including the device type, the iOS version being signed, and the device's ECID (a unique identification number embedded in its hardware).<ref name="stefanesser">{{cite web |url= http://antid0te.com/CSW2012_StefanEsser_iOS5_An_Exploitation_Nightmare_FINAL.pdf |title= iOS 5: An Exploitation Nightmare? |author= Stefan Esser |date= March 2012 |work= |publisher= CanSecWest Vancouver |accessdate=3 December 2012}}{{dubious|date=January 2013}}</ref> When Apple wishes to restrict users' ability to restore their devices to a particular iOS version, Apple can refuse to generate this hash during the restore attempt, and the restore will not be successful (or at least will require bypassing the intended function of the system).<ref>{{cite web |url= http://lifehacker.com/5795242/save-your-idevices-shsh-to-avoid-losing-the-ability-to-jailbreak-your-idevice |title= Save Your iDevice’s SHSH to Avoid Losing the Ability to Jailbreak |author= Adam Dachis |date= April 25, 2011 |work= |publisher= Lifehacker |accessdate=August 2, 2011}}</ref><ref>{{cite web |url= http://www.techrepublic.com/blog/mac/apple-ios-6-woes-save-the-blobs-if-you-need-to-downgrade/2340 |title= Apple iOS 6 woes: Save the blobs if you need to downgrade |last1= Smith |first1= Gina |last2= |first2= |date= September 27, 2012 |work= Apple in the Enterprise |publisher= TechRepublic |accessdate=December 30, 2012}}</ref>


This protocol is part of ] and later devices.<ref name="saurik-shsh">{{cite web |url=http://www.saurik.com/id/12 |title=Caching Apple's Signature Server |date= September 2009 |author= Jay Freeman (saurik) |accessdate=December 3, 2012 |publisher=Saurik.com}}</ref><ref name="cultofmac-extract"/> This protocol is part of ] and later devices.<ref name="saurik-shsh">{{cite web |url=http://www.saurik.com/id/12 |title=Caching Apple's Signature Server |date= September 2009 |author= Jay Freeman (saurik) |accessdate=December 3, 2012 |publisher=Saurik.com}}</ref>


== Exploits and countermeasures == == Exploits and countermeasures ==

Revision as of 00:16, 10 January 2013

This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these messages)
The topic of this article may not meet Misplaced Pages's general notability guideline. Please help to demonstrate the notability of the topic by citing reliable secondary sources that are independent of the topic and provide significant coverage of it beyond a mere trivial mention. If notability cannot be shown, the article is likely to be merged, redirected, or deleted.
Find sources: "SHSH blob" – news · newspapers · books · scholar · JSTOR (January 2013) (Learn how and when to remove this message)
This article may be unbalanced toward certain viewpoints. Please improve the article by adding information on neglected viewpoints, or discuss the issue on the talk page. (December 2012)
(Learn how and when to remove this message)

SHSH blob is a jargon term for a small piece of data that is part of Apple's digital signature protocol for iOS restores and updates, designed to control the iOS versions that users can install on their iOS devices (iPhones, iPads, iPod touches, and Apple TVs), generally only allowing the newest iOS version to be installable. Developers interested in iOS jailbreaking have made tools for working around this signature system in order to install jailbreakable older iOS versions that are no longer being signed by Apple.

Technical details

The term "SHSH blobs" (also called "ECID SHSH") is a non-Apple official term referring to digital signatures that Apple generates and uses to personalize IPSW (iOS software) files for each device; they are part of Apple's protocol designed to ensure that trusted software is installed on the device. Apple's public name for this process is System Software Personalization.

SHSH blobs are created by a hashing formula that has multiple keys, including the device type, the iOS version being signed, and the device's ECID (a unique identification number embedded in its hardware). When Apple wishes to restrict users' ability to restore their devices to a particular iOS version, Apple can refuse to generate this hash during the restore attempt, and the restore will not be successful (or at least will require bypassing the intended function of the system).

This protocol is part of iPhone 3GS and later devices.

Exploits and countermeasures

A major contributor to this article appears to have a close connection with its subject. It may require cleanup to comply with Misplaced Pages's content policies, particularly neutral point of view. Please discuss further on the talk page. (December 2012) (Learn how and when to remove this message)
This section may contain material not related to the topic of the article. Please help improve this section or discuss this issue on the talk page. (January 2013) (Learn how and when to remove this message)
This page or section may contain link spam masquerading as content. Spam on Misplaced Pages consists of external links mainly intended to promote a website. If you are familiar with the content of the external links, please help by removing promotional links in accordance with Misplaced Pages:External links. (January 2013)

For iOS 3 and 4, SHSH blobs were made of static keys (such as the device type, iOS version, and ECID), which meant that the SHSH blobs for a specific iOS version and device would be the same upon every restore. To subvert that system using a man-in-the-middle attack, server requests the unique SHSH blobs from Apple for the jailbroken device and caches those SHSH blobs on servers, so that if a user changes the hosts file on a computer to redirect the SHSH blobs check to cache instead of Apple's servers, iTunes would be tricked into checking those cached SHSH blobs and allowing the device to be restored to that version.

iOS 5 and later versions of iOS implement an addition to this system, a random number (a cryptographic nonce) in the "APTicket", making that simple replay attack no longer effective. Versions of redsn0w after 0.9.9b9 include a way to bypass the nonce requirement, allowing the SHSH blobs and APTicket to both be replayed by "stitching" them into custom firmware.

First released in 2009 (as TinyTSS and Umbrella), TinyUmbrella is a tool for finding out information about SHSH blobs saved on third party servers, saving SHSH blobs locally, and running a local server to replay SHSH blobs to trick iTunes into restoring older devices to iOS 3 and 4. In June 2011, iH8sn0w released iFaith, a tool that can grab partial SHSH blobs from a device for its currently-installed iOS version (limited to iPhone 4 and older devices). In late 2011, the iPhone Dev Team added comprehensive SHSH blob management features to redsn0w, including the ability to save SHSH blobs with APTickets and stitch them into custom firmware in order to restore a device to iOS 5 or later.

Replaying SHSH blobs for newer devices (iPad 2 and later) is not always possible, because there are no boot ROM (hardware level) exploits available for these devices. As of October 2012, redsn0w includes features for restoring newer devices between different versions of iOS 5, but it cannot downgrade newer devices from iOS 6 to iOS 5.

See also

References

  1. Nat Futterman (May 25, 2010). "Jailbreaking the iPad: What You Need to Know". Geek Tech. PCWorld. Retrieved August 2, 2011.
  2. Kumparak, Greg (June 27, 2011). "Apple Steps Up Their Game with iOS 5, Makes Jailbreaking More Difficult". TechCrunch. Retrieved December 30, 2012.
  3. Stern, Zack (July 5, 2010). "How to jailbreak your iPad and start multitasking immediately". ITBusiness.ca. Retrieved December 30, 2012.
  4. Asad, Taimur (April 30, 2010). "Save SHSH Blobs (ECID SHSH) of iPhone 3.1.3 and iPad 3.2". Redmond Pie. Retrieved December 30, 2012.
  5. Apple Inc. (May 2012). "iOS Security" (PDF). Apple Inc. Retrieved 3 December 2012.
  6. Stefan Esser (March 2012). "iOS 5: An Exploitation Nightmare?" (PDF). CanSecWest Vancouver. Retrieved 3 December 2012.
  7. Adam Dachis (April 25, 2011). "Save Your iDevice's SHSH to Avoid Losing the Ability to Jailbreak". Lifehacker. Retrieved August 2, 2011.
  8. Smith, Gina (September 27, 2012). "Apple iOS 6 woes: Save the blobs if you need to downgrade". Apple in the Enterprise. TechRepublic. Retrieved December 30, 2012.
  9. ^ Jay Freeman (saurik) (September 2009). "Caching Apple's Signature Server". Saurik.com. Retrieved December 3, 2012.
  10. Hoog, Andrew; Strzempka, Katie (2011). iPhone and iOS Forensics: Investigation, Analysis and Mobile Security for Apple iPhone, iPad and iOS Devices. Elsevier. pp. 47–50. ISBN 9781597496599. Retrieved December 3, 2012.
  11. Cheng, Jacqui (June 27, 2011). "iOS 5 beta hobbles OS downgrades, untethered jailbreaks". Infinite Loop. Ars Technica. Retrieved December 30, 2012.
  12. Oliver Haslam (June 27, 2011). "iOS 5 Will Halt SHSH Firmware Downgrades On iPhone, iPad, iPod touch". Redmond Pie. Retrieved November 12, 2011.
  13. Levin, Jonathan (2012). Mac OS X and iOS Internals: To the Apple's Core. John Wiley & Sons. p. 214. ISBN 9781118222256. Retrieved December 29, 2012.
  14. iPhone Dev Team (August 2011). "redsn0w iOS5beta". iPhone Dev Blog. Retrieved January 4, 2012.
  15. notcom (September 19, 2009). "TinyTSS -- All your iphone restores are belong to you". The Firmware Umbrella. Retrieved 3 December 2012.
  16. notcom (May 20, 2010). "TinyUmbrella - Unified TinyTSS and The Firmware Umbrella in ONE!". The Firmware Umbrella. Retrieved 1 January 2013.
  17. Brownlee, John (November 15, 2011). "TinyUmbrella Updated To Support Backing Up iPhone 4S And iOS 5.0.1 SHSH Blobs". Cult of Mac. Retrieved December 30, 2012.
  18. Sayam Aggarwal (July 26, 2010). "Before Jailbreaking, Extract Your iPhone's SHSH Blobs with Umbrella". Cult of Mac. Retrieved 3 December 2012.
  19. Landau, Ted (April 22, 2011). "TinyUmbrella and ITunes 1013 Error Strike Again". MacWorld. PCWorld. Retrieved December 30, 2012.
  20. Goncalo Ribeiro (June 3, 2011). "How To Save SHSH Blobs Of Any Old Firmware Running On Your iPhone, iPad, iPod touch Using iFaith". Redmond Pie. Retrieved 3 December 2012.
  21. Morris, Paul (December 24, 2011). "Cydia Is Now Saving SHSH Blobs For iOS 5.0.1 Firmware". Redmond Pie. Retrieved December 30, 2012.
  22. Jeff Benjamin (September 27, 2011). "How to Stitch Your SHSH Blobs Using RedSn0w to Create Firmware That Can Always Be Downgraded". iDownloadBlog. Retrieved 3 December 2012.
  23. iPhone Dev Team (October 2012). "Restoration reinvigoration". Dev Team Blog. Retrieved 3 December 2012.
  24. iPhone Dev Team (September 2012). "Blob-o-riffic". Dev Team Blog. Retrieved 3 December 2012.
  25. Morris, Paul (October 14, 2012). "How To Re-Restore iPhone 4S, iPad 3, iPad 2, iPod touch From iOS 5.x To iOS 5.x Using Redsn0w". Redmond Pie. Retrieved December 30, 2012.
Categories:
SHSH blob: Difference between revisions Add topic