25C3 presentation "Hacking the iPhone"

This was a presentation held on the 27 December 2008 at the 25th Chaos Communication Congress (25C3) in Berlin. Speakers were pytey, planetbeing and MuscleNerd.

The presentation explained the inner workings of the iOS architecture, its security, and how it was circumvented. Short event description

During the presentation MuscleNerd wanted to show the video of a live demo of the unlock with (yellowsn0w), but skipped it because of the missing time. This video was actually released some days before.

Conference Recordings

• Conference recording video on Vimeo
• Conference recording video in H264 or via FTP or torrent link. This version is the best quality available.
• Conference recording video in M4V
• Conference recording as MP3 audio
• Conference recording as OGG audio
• Official download page (look for presentation 2976)
• Official FTP server (look for presentation 2976)

The presentation slides are currently not available. Maybe one of the presentators can upload them here or post a link.

Transcript of the presentation

Start

A01

Good evening everybody. I would like to introduce the iPhone Dev Team who are here to give a talk on iPhone hacking. So if you join me to give a round full of applause please.

Introduction (by pytey)

Good evening ladies and gentlemen. Here’s a little slide show here for you.

B01

This is a slide called hacking the iPhone. I’ll give a little history here about our little crew.

B02

We formed in June 2007, just before the release of the original iPhone. We’re original hardware hackers and device enthusiasts, based around Apple products and we sort of rather say towards the iPhone as a platform. We exist on IRC. This is the first time most of us have met each other. Originally there was a couple of channels on the osx86.hu server.

B03

We’ve got a wide membership: Germany, Belgium, France, Russia, Hungary, USA, Israel. And during those initial few months of the iPhone first generation DHL and FedEx shipped around a lot of US phones to us. We’ve got some statistics here of our little site. We’ve had about 1.7 million visits in the last month. Fifty, sixty thousand unique visitors per day and various networks around. We’ve got a tool called Pwnage tool and another tool called QuickPwn which is viewed here as the next good project. It’s a Cocoa application. It’s got 20,000 lines of code. QuickPwn has got 15,000 lines of code. There’s also other platforms: Windows and Linux as well. We’ve had 3.6 million Sparkle updates since we last deleted our logs, which was in the 16th of July. We try to release patches when Apple releases an iPhone update. We try to get patches out 24-48 hours after the release of those updates. And the modular bundle sets for cross-platform use. We sparkle for updates for the Mac platform, as I mentioned. An interesting lead: There’s a 180 very active users from Apple who update their QuickPwn and Pwnage tool on a regular basis, so I think they like our software, which is pretty cool. Thank you very much Apple. (big applause)

I’ll just introduce my colleagues here. We’ve got bushing on the end. He’s one of the guys. This is MuscleNerd (laughter) - I don’t know why. This is planetbeing. And we’ve got a bunch of other guys here we don’t want to be identified for obvious reasons, but they’re over there wearing Pwn-Apple T-shirts. And they speak Russian. (laughter) Say hi guys! (applause)

So with that further I’ll hand you over to planetbeing who’s gonna talk a bit about the applications processor side of the iPhone. Thanks.

Part 1: Applications Processor (by planetbeing)

(in work by http, will follow here)

Part 2: Baseband (by MuscleNerd)

(in work by http, will follow here)

End and Q&A

(in work by http, will follow here)