Apple’s secret source code for a vital part of the iPhone’s operating system was leaked on the code-sharing server site GitHub on Wednesday.
A report from Motherboard said the code, aptly named iBoot, could be retrieved on GitHub, a hosting service for software developers to publish and share code.
Here’s Apple on the leak:
“Old source code from three years ago appears to have been leaked, but by design the security of our products doesn’t depend on the secrecy of our source code. There are many layers of hardware and software protections built into our products, and we always encourage customers to update to the newest software releases to benefit from the latest protections.”
The vast majority of iPhone users are now using iOS 10 and iOS 11, which both contain code that is newer than what was leaked.
Still, Apple also requested GitHub take down the code — and in doing so confirmed the leaked code is real as part of the takedown letter.
The code seems to belong to an older version of iOS (presumably iOS 9, released in 2015) but parts of it might be used in iOS 11, the latest version.
iBoot essentially turns on iPhones and other iOS devices. It’s the very first thing activated when someone pushes the sleep/wake button. It loads, verifies that the kernel — the heart of the operating system’s code — is signed by Apple, then executes the code and takes you to the lock screen.
Jonathan Levin, the chief technology officer of the software security firm Technologeeks who has written several books on the subject, told Motherboard that “this is the biggest leak in history” and said it appeared that the code — whose source is unknown — was legit.
“It’s a huge deal,” Levin said.
Levin later said in a tweet that he didn’t say the leak was the biggest in history.
Apple did not respond to Business Insider’s request for comment.
Access to iBoot’s code could allow researchers to more easily find vulnerabilities in the systems. But it might also open the door to hackers wanting to exploit the hole.
Hackers could find bugs that let them crack or decrypt an iPhone — despite extra security steps built into each new iOS device — or even emulate the operating system on non-Apple products.
Levin told Motherboard that the code was most likely circulating widely in the underground iOS jailbreaking community.
“iBoot is the one component Apple has been holding on to, still encrypting its 64-bit image,” Levin said. “And now it’s wide open in source code form.”
