Did you hear that two rabbits escaped from the zoo and so far they have only recaptured 116 of them?</s>With security flaws and data breaches seemingly becoming the norm lately, it may come as no surprise to learn that yet another major security issue has cropped up, this time for Apple users.

As reported by Motherboard, certain "key" iOS source code was recently published on Github for the world to see. While Apple later filed a copyright takedown request which forced Github to take the code in question down, the harm may well have already been done.

The code, labeled "iBoot," is responsible for loading up iOS and verifying the kernel is "properly signed" by Apple. As noted by Motherboard, this code is essentially an iOS device's BIOS.

"This is the biggest leak in history," iOS device internals expert Jonathan Levin told the outlet, adding that it's a "huge deal" for Apple's users. With the code out in the world, hackers could probe it for vulnerabilities and find ways to exploit the system to the detriment of the greater iOS user base. On the other hand, researchers may also choose to poke about in the iBoot code, potentially disclosing any vulnerabilities they find to Apple.

Still, it's worth noting that this leaked source code was reportedly specific to iOS 9. While some code has almost certainly been reused in iOS updates released since then, it might be harder for hackers to take advantage of now.</s>Someone has published the purported source code for the iOS bootloader, iBoot, potentially opening the door for hackers and jailbreakers to find vulnerabilities in Apple's mobile OS.

Motherboard reports that the iBoot source code for iOS 9 was leaked on GitHub and, although it is an older version of iOS, parts of it probably remain in the current iOS 11.

iBoot is a core part of iOS's secure boot chain, a highly sensitive process that happens when an iOS device is switched on.

The secure boot chain ensures the lowest levels of software in the OS haven't been tampered with and only loads software signed by Apple, according to Apple's iOS security whitepaper.

Because of the sensitivity of the component, Apple offers its highest $200,000 reward in its iOS bug bounty scheme to researchers who find vulnerabilities in secure boot firmware.

Jonathan Levin, an author of several books on iOS and OS X development, told the publication the iBoot source code appears to be real as it matched code he'd reverse-engineered.

Levin said it was a "huge deal" for Apple as it would give researchers clues to find vulnerabilities that could be used to compromise, jailbreak and decrypt iOS devices.

It's not known who leaked the source code on GitHub but it first appeared four months ago via a link on Reddit posted by a user called 'apple_internals'. However, that leak -- which was hosted on Mega and is no longer available -- went largely unnoticed.

While Apple has open-sourced parts of iOS, Levins noted that it has continued to closely guard iBoot's 64-bit image.

The GitHub repositories containing the leaked iBoot source code have been taken down and replaced with a DMCA notice from one of Apple's law firms, Kilpatrick Townsend & Stockton, which cites Apple's ownership. The DMCA takedowns have also been applied to over a dozen cloned iBoot repositories.

In a section explaining the reasons for the takedown and content type, the law firm says the notice covers "reproduction of Apple's iBoot source code, which is responsible for ensuring trusted boot operation of Apple's iOS software. The iBoot source code is proprietary and it includes Apple's copyright notice. It is not open source."

New to iOS 11? Change these privacy and security settings right now

Before you do anything on your iPhone or iPad, you should lock it down. This is how you do it.

Just one day after its release, iOS 11.1 hacked by security researchers

The bugs were found in Apple's Safari web browser

The upcoming iOS 11 update means you'll never have to remember your app password again.

iOS 11 tips and tricks you might not know (TechRepublic)

Get the most out of your iPad and iPhone running iOS 11 by using these hidden features and productivity tweaks.

With the iPhone X, there's a lot to learn. We have your back, though.</s>Apple is used to fighting leaks about its upcoming products and OS releases, but it’s never had to deal with anything like this before. An anonymous user on the popular code-sharing server GitHub has posted a major component of the iOS source code for all to see, and some experts are fearing it could be “the biggest leak in history.”

As first reported by Motherboard, the leaked code has since been pulled off the site but not before countless people were surely able to get their hands on it. Apple was forced to use the Digital Millennium Copyright Act to get the code taken down, and as UW research scientist Karl Koscher mused on Twitter, the law essentially forces Apple to admit that the code was real or else face perjury charges. In the DMCA takedown letter, Apple's legal team writes that the content in question is a "reproduction of Apple's "iBoot" source code, which is responsible for ensuring trusted boot operation of Apple's iOS software. The 'iBoot' source code is proprietary and it includes Apple's copyright notice. It is not open-source."

The code in question is for a version of iOS 9.3, which was released in spring 2016 and brought features such as Night Shift and various other improvements. The portion of the code that leaked is called iBoot, and as its name suggests, it controls the trusted boot-up process that springs into action every time you start up your iPhone. According to Apple, the iOS bootloader "is the first step in the chain of trust where each step ensures that the next is signed by Apple." If it is compromised, it could allow infected software to run on the device.

In a statement, Apple said, "Old source code from three years ago appears to have been leaked, but by design the security of our products doesn't depend on the secrecy of our source code. There are many layers of hardware and software protections built into our products, and we always encourage customers to update to the newest software releases to benefit from the latest protections."

While the leak is certainly embarrassing, it could also be dangerous. Apple’s boot process is the most essential part of its iOS code, providing front-line protection against malware and other attacks. It’s so sensitive, in fact, that Apple shells out up to $200,000 to developers who find vulnerabilities, according to reports on the invitation-only program.

While the code is for a two-year-old OS and nearly 95 percent of users are on later versions of iOS, it’s likely that parts of it are still in use even in the most recent version of iOS 11. The most likely use for the iBoot code would be for creating jailbroken versions of iOS, but intimate knowledge of iOS’s source code could benefit hackers as well, as it provides an unprecedented look at how the iOS sausage is mode. By digging through the source code, malicious coders could spot vulnerabilities and inconsistencies in the code that could be used to attack all version of iOS, not just 9.3.

The impact on you at home: For the average user, there probably isn’t much to fear, at least not yet. To attack your phone using anything discovered in the iBoot leak, a hacker would likely need physical access to your phone and a bit of time to install a new OS on it. However, it does mean that hackers will be hard at work to find exploits in the code, as well as designers looking to emulate the iOS system. And it’s just one more unfortunate security story Apple has to deal with.</s>iOS source code leak could be the worst Apple’s ever had to deal with

Apple is used to fighting leaks about its upcoming products and OS releases, but it’s never had to deal with anything like this before. An anonymous user on the popular code-sharing server GitHub has posted a major component of the iOS source code for all to see, and some experts are fearing it could be “the biggest leak in history”.

As first reported by Motherboard, the leaked code has since been pulled off the site but not before countless people were surely able to get their hands on it. Apple was forced to use the Digital Millennium Copyright Act to get the code taken down, and as UW research scientist Karl Koscher mused on Twitter, the law essentially force Apple to admit that the code was real or else face perjury charges.

The code in question is for a version of iOS 9.3, which was released in spring 2016 and brought features such as Night Shift and various other improvements. The portion of the code that leaked is called iBoot, and as its name suggests, it controls the trusted boot-up process that springs into action every time you start up your iPhone.

While the leak is certainly embarrassing, it could also be dangerous. Apple’s boot process is the most essential part of its iOS code, providing front-line protection against malware and other attacks. It’s so sensitive, in fact, that Apple shells out up to $200,000 to developers who find vulnerabilities, according to reports on the invitation-only programme.

While the code is for a two-year-old OS, it’s likely that parts of it are still in use in the latest version of iOS 11. The most likely use for the iBoot code would be for creating jailbroken versions of iOS, but intimate knowledge of iOS’s source code could benefit hackers as well, as it provides an unprecedented look at how the iOS sausage is mode. By digging through the source code, malicious coders could spot vulnerabilities and inconsistencies in the code that could be used to attack all version of iOS, not just 9.3.

For the average user, there probably isn’t much to fear, at least not yet. To attack your phone using anything discovered in the iBoot leak, a hacker would likely need physical access to your phone and a bit of time to install a new OS on it. However, it does mean that hackers will be hard at work to find exploits in the code, as well as designers looking to emulate the iOS system. And it’s just one more embarrassing security story Apple has to deal with.</s>Apple is notorious for keeping its source code close to its chest, but someone just leaked a heap of very sensitive code online. A user known as “q3hardcore” posted large segments of Apple’s secure iBoot code to GitHub. The company issued a DMCA takedown request, but the code is out there in the wild now. This could lead to new attacks and vulnerabilities for iOS, but jailbreaking might also come back.

The iBoot framework is a low-level piece of software on all Apple hardware running iOS — on other devices, you’d call this the bootloader or the BIOS. It’s the first thing that starts up when the phone is turned on, because it loads the kernel and verifies that it was signed by Apple. Attempting to boot a modified kernel will immediately throw up a red flag in iBoot. Apple considers this code so integral to its security model that it offers a $200,000 bug bounty for vulnerabilities.

This code is from iOS 9, circa 2014. However, security researchers suspect that much of the code is still active in iOS 10. A handful of key files are missing, so it cannot be compiled. However, security researcher Jonathan Levin confirms the code is the real deal as it matches some iBoot code he himself has reverse engineered. Apple’s quick DMCA filing also strongly suggests the leak is real.

Flaws in older versions of iBoot have been leveraged by hackers to compromise the iPhone’s security, but users have also relied on the vulnerabilities for jailbreaking. That’s the equivalent of getting root access on an Android phone. Apple’s use of the Secure Enclave processor in newer iPhones has effectively killed the jailbreaking community. It takes a lot of time and expertise to uncover vulnerabilities, and they’re highly prized by security firms. These days, modders are more likely to sell the exploit than release it for free to the jailbreak community. This source code leak could change all that, though.

Security researchers and jailbreak developers are no doubt pouring over the iBoot code. Levin suggests that so-called “tethered” jailbreaks that require connecting the phone to a computer could become a reality again soon. These relatively simple jailbreaks have been blocked for several years by the Secure Enclave. However, it’s important to remember these jailbreaks are security holes that someone could use to steal data or damage your device. Apple is probably going to be working overtime for the foreseeable future to deal with the fallout from this leak.</s>Apple may have just released iOS 11.3 beta 2, but the attention of world turned to the iOS source code that leaked to GitHub. The iPhone maker has confirmed that code for iOS 9's iBoot had leaked, but stressed its age.

The company said that the leak does not pose a security threat to users, insisting that "the security of our products doesn't depend on the secrecy of our source code." But while Apple tries to play down the leak, there's no denying that it is highly significant and an unprecedented embarrassment.

The implication from the company is that even if the very latest version of the source code leaked, it would still not represent a security threat, and this was further reduced by the age of the code. With Apple's iOS upgrade program, the number of people still running iOS 9 is relatively small, with 93 percent of users working with iOS 10 or newer.

Old source code from three years ago appears to have been leaked but by design the security of our products doesn't depend on the secrecy of our source code. There are many layers of hardware and software protections built in to our products, and we always encourage customers to update to the newest software releases to benefit from the latest protections.

But even if the code leak is not a security risk, the mere fact that it made its way into the outside world is something that Apple will be deeply concerned about. The security implications may have been small this time, but that may not be the case with a future leak.</s>Apple has indirectly confirmed the code for a critical iOS component was leaked on open-source sharing site GitHub. The closely guarded code was quickly removed, but not before it had been viewed, downloaded and archived by hundreds of developers. iOS bootloader The leak could be of value to "jailbreakers" who install third-party software on iPhones and iPads. There are also concerns it could uncover new security vulnerabilities in iOS, which may be found by attackers. The code comes from a low-level iOS component called "iBoot" which is a trusted part of the platform. iBoot acts as a bootloader for the rest of iOS. After an iPhone or iPad is turned on, iBoot loads and begins to start the main iOS processes. It's responsible for verifying the kernel is genuine and then commencing its execution. Without iBoot, iOS wouldn't be able to start. The leak is so significant because of the importance of iBoot's role to the wider iOS platform. As one of the earliest components to start up, it has access to the entire system and the processes that run on it. It also supports provisioning over a cable, which could allow iOS hackers to interact with it and load custom code. READ NEXT: 70% of consumers would boycott services with poor data protection The release, presumably made by an Apple insider, has been Apple isn't prone to open-sourcing its code so most understanding of iOS' internals has been acquired through reverse-engineering attempts. Apple keeps iBoot under a particularly close guard because of its low-level nature and role in the operating system. Bugs in the iOS boot process are the most valuable ones to be covered by the company's bug bounty program, receiving a maximum payout of $200,000. They may be easier to find now the iBoot source has been distributed. "Not open-source" The code was uploaded to GitHub by a user account known as "ZioShiba." It was public on the site for a short while until Apple The repository has now been removed from public view on the Internet. Although Apple hasn't directly commented on the breach's authenticity, its expedited DMCA request strongly implies the source was genuine code. "[iBoot] is responsible for ensuring trusted boot operation of Apple's ioS software. The 'iBoot' source code is proprietary and it includes Apple's copyright notice. It is not open-source," said Although the source was only available for a short time, it's likely that hundreds of people viewed and downloaded the material while it was available. Apple's now having to follow-up with takedown requests against scores of users who are independently re-uploading the code. Its The leak could be of value to "jailbreakers" who install third-party software on iPhones and iPads. There are also concerns it could uncover new security vulnerabilities in iOS, which may be found by attackers. The code comes from a low-level iOS component called "iBoot" which is a trusted part of the platform.iBoot acts as a bootloader for the rest of iOS. After an iPhone or iPad is turned on, iBoot loads and begins to start the main iOS processes. It's responsible for verifying the kernel is genuine and then commencing its execution. Without iBoot, iOS wouldn't be able to start.The leak is so significant because of the importance of iBoot's role to the wider iOS platform. As one of the earliest components to start up, it has access to the entire system and the processes that run on it. It also supports provisioning over a cable, which could allow iOS hackers to interact with it and load custom code.The release, presumably made by an Apple insider, has been described by iOS expert Jonathan Levin as "the biggest leak in history." Levin has written books on the internals of iOS and Mac OS X and said the code aligns with sections of iBoot he's reverse-engineered.Apple isn't prone to open-sourcing its code so most understanding of iOS' internals has been acquired through reverse-engineering attempts. Apple keeps iBoot under a particularly close guard because of its low-level nature and role in the operating system. Bugs in the iOS boot process are the most valuable ones to be covered by the company's bug bounty program, receiving a maximum payout of $200,000. They may be easier to find now the iBoot source has been distributed.The code was uploaded to GitHub by a user account known as "ZioShiba." It was public on the site for a short while until Apple submitted a DMCA takedown request, which was accepted by GitHub.The repository has now been removed from public view on the Internet. Although Apple hasn't directly commented on the breach's authenticity, its expedited DMCA request strongly implies the source was genuine code."[iBoot] is responsible for ensuring trusted boot operation of Apple's ioS software. The 'iBoot' source code is proprietary and it includes Apple's copyright notice. It is not open-source," said Apple in its request, through lawyers Kilpatrick Townsend & Stockton LLP. "Please act expeditiously to disable the content found at the following repository (and any related forks)."Although the source was only available for a short time, it's likely that hundreds of people viewed and downloaded the material while it was available. Apple's now having to follow-up with takedown requests against scores of users who are independently re-uploading the code. Its latest DMCA notice lists over 200 GitHub repositories which the company wants disabled in relation to the iBoot leak.</s>The source code for Apple’s iBoot, the little-known but critically important secure bootloader for iOS, leaked online yesterday. Apple this morning confirmed the leak by filing a DMCA copyright takedown request with the code’s host, GitHub.

Though the publication of iBoot was enthusiastically dubbed “the biggest leak in history” in the initial Motherboard report, the source code is believed to be from three-generations-old iOS 9. It is thus likely mostly a concern for users of older iOS devices lacking the “secure enclave,” a hardware security feature found in all Touch ID devices since the iPhone 5s.

iBoot is not labeled or marketed by Apple in any way. It is, however, the first app that runs when you turn on an iOS device, silently transitioning from a black screen to the white Apple icon to iOS’s colorful Home screen.

iBoot is designed to guarantee that a valid, trusted version of iOS is being loaded, and unlike other portions of iOS that have been open-sourced, it’s been kept opaque for security reasons. Apple considers bugs in iBoot to be so important that it pays security researchers up to $200,000 per vulnerability.

The disclosure of iBoot’s source code could considerably improve hackers’ chances of spotting issues, and reignite a jailbreaking scene that has all but dried up as iOS’s hardware and software security have improved. Motherboard speculates that the leak could also enable programmers to emulate iOS on non-Apple platforms.

That said, it’s unclear how much of the iOS 9-vintage code remains in the current iOS 11 and near-future iOS 12 iBoot process, nor how improvements to the secure enclave hardware may have mitigated risks to almost all iOS devices currently being sold.</s>The source code for Apple’s iBoot, the little-known but critically important secure bootloader for iOS, leaked online yesterday. Apple this morning confirmed the leak by filing a DMCA copyright takedown request with the code’s host, GitHub.

Though the publication of iBoot was enthusiastically dubbed “the biggest leak in history” in the initial Motherboard report, the source code is believed to be from three-generations-old iOS 9. It is thus likely mostly a concern for users of older iOS devices lacking the “secure enclave,” a hardware security feature found in all Touch ID devices since the iPhone 5s.

iBoot is not labeled or marketed by Apple in any way. It is, however, the first app that runs when you turn on an iOS device, silently transitioning from a black screen to the white Apple icon to iOS’ colorful Home screen.

iBoot is designed to guarantee that a valid, trusted version of iOS is being loaded. Unlike other portions of iOS that have been open-sourced, it’s been kept opaque for security reasons. Apple considers bugs in iBoot to be so important that it pays security researchers up to $200,000 per vulnerability.

The disclosure of iBoot’s source code could considerably improve hackers’ chances of spotting issues, and reignite a jailbreaking scene that all but dried up as iOS’s hardware and software security improved. Motherboard speculates that the leak could also enable programmers to emulate iOS on non-Apple platforms.

That said, it’s unclear how much of the iOS 9-vintage code remains in the current iOS 11 and near-future iOS 12 iBoot process, nor how improvements to the secure enclave hardware may have mitigated risks to almost all iOS devices currently being sold.

Updated at 10:54 a.m. Pacific: An Apple spokesperson provided the following statement: “Old source code from three years ago appears to have been leaked, but by design the security of our products doesn’t depend on the secrecy of our source code. There are many layers of hardware and software protections built into our products, and we always encourage customers to update to the newest software releases to benefit from the latest protections.”

To put iOS 9’s current installed base in some perspective, Apple’s App Store developer page currently shows that 93% of iOS devices are running either iOS 10 or iOS 11.
A Vice Motherboard report traces the origin of a significant iOS source code leak to an Apple intern and five "friends" in the iOS jailbreaking community.