Hacker News new | ask | show | jobs
by krunkcoin 1094 days ago
Outside of a handful of special ultra-unlocked iPhones Apple sells (or loans maybe? Don't remember the details) to security researchers, no, you cannot reliably boot your own OS on iPhone hardware. Apple's secure boot ROM only trusts bootloaders cryptographically signed by Apple's private signing key.

Short of finding a flaw in that ROM or a jailbreak good enough to take over from the booted iOS, there's no path to booting something else. While people have found such boot ROM and jailbreak flaws in the past, recent hardware and iOS have no known vulnerabilities good enough to take over (AFAIK). (and note also that Apple guards against rollback attacks on iOS devices - once you've upgraded a device to a new iOS version, there's no going back to an older version with a jailbreak.)

The complexity of Apple's hardware is not a barrier. Apple Silicon Macs run essentially the same hardware as iPhone, only more complex (because there's more stuff to support in the bigger SoCs they put in Macs). When Apple updated their secure boot to work well for Mac, they chose to explicitly support that which is forbidden on iPhones: they give users an interface allowing them to locally sign a bootloader and store a cryptographic hash in the Secure Enclave so that the boot ROM will trust it just as if the bootloader had been provided by Apple. Because this path exists, people have been reverse engineering Apple's SoCs and there's a working Linux distro (Asahi Linux) and a BSD port. Not everything works yet, but a surprising amount does.

1 comments

It seems you're right -- I'm not in the "install other OSes" business, and I didn't know about the bootloader restriction. I was going off the fact that jailbreaks existed at some point, I didn't know that more recent iPhones have gotten harder/impossible to break.

And certainly, since the concept of hardware lockdown pretty much wasn't a thing twenty years ago, the Jornada probably puts up no intentional barriers.

I think the complexity issue holds -- it doesn't make it impossible, but surely it's easier to implement an alternative OS for something as simple as the Jornada. Although playing devil's advocate, the Asahi page only lists 8 people (compared to the 5 for the Jornada) so it can't be that much more complex. And it's irrelevant because of the bootloader thing.

It appears from some quick reading that the bootloader is a security technique -- that same lockdown that prevents alternative OSes also prevents malware. I understand if people disagree, but that seems like a reasonable trade-off to me.