Apple quietly drops iOS jailbreak detection API

Version 4.2 disables a query to discover compromised OS

Apple has disabled, without explanation, a jailbreak detection API in iOS less than six months after introducing it. Device management vendors say the reasons for the decision are a mystery, but insist they can use alternatives to discover if an iPhone, iPod touch or iPad has been modified so they can load and modify applications outside of Apple's iTunes-based App Store.

Jailbroken devices pose a serious security threat to the enterprise. Even if the end user doesn't intend to load malware, he will be completely unaware of malware present in unauthorized apps.

Managing smartphones calls for new realism and flexibility

Page 2 of 2

For a group of computer-savvy end users, jailbreaking is an unalloyed benefit, not to mention a civil right, letting them load any applications they wish. But for enterprise IT, jailbroken iOS devices create a serious security threat.

"When jailbreaking and or rooting a [mobile] device, the goal is to circumvent or disable the pieces of the OS and platform that keep applications in a sandbox and running with limited privileges," Allen wrote in a recent blogpost on trusting mobile platforms. "These devices could be difficult, or even impossible, to enforce security policy on as the user can trivially circumvent the policy enforcement without the management servers being aware of it."

MDM vendors such as Good Technology, MobileIron and Sybase all claim to be able to detect jailbroken iOS devices without the disabled Apple API. Typically, their on-device apps, in conjunction with the server, run a series of checks or try to do things that are forbidden by Apple, such as accessing certain underlying OS primitives. If the app can take these actions, it reports back that the device is jailbroken, and then can block or restrict access to the corporate network.

These techniques are not foolproof, cautions Intrepidus' Jeremy Allen.

"These methods cannot be relied upon with a high degree of confidence, but they would certainly catch many who jailbreak, just not all of them," he says. "I see it as a useful tool, but not an all-encompassing solution."

Allen strongly encourages enterprises to take a multi-layered approach and be realistic about the risks. "I always stress, heavily, [the importance of] educating users about the risks of jailbreaking," he says. "I feel that organizations must outline, in formal policy, that jailbreaking is not permitted. Many users are simply unaware of the risks associated with operating a jailbroken device."

Given the ongoing ingenuity of hackers, enterprises have to be plan accordingly, Allen warns. "For the users that still engage in jailbreaking, with full knowledge of the risks and detection mechanisms, there is little recourse to finding them," he says.

John Cox covers wireless networking and mobile computing for "Network World."

Twitter: http://twitter.com/johnwcoxnww

Blog RSS feed: http://www.networkworld.com/community/blog/2989/feed

Read more about wireless & mobile in Network World's Wireless & Mobile section.