iH8Sn0w Discovers APTicket Vulnerability for Easy 5.1 Downgrade

Freddy Kellison-Linn March 25, 2012 9

Popular iOS jailbreaker iH8Sn0w tweeted yesterday that he has found a “loophole” in Apple’s APTicket system for signing firmwares. For those that don’t know, Apple began requiring approval from their servers before allowing a device to restore to a certain firmware, so they could keep people from downgrading to older, less secure versions.

This originally used SHSH blobs, but those were cracked fairly quickly, and a spoof server was set up that allowed devices with saved SHSH blobs to downgrade. However, as iOS 5 came around, Apple began transitioning to a new system known as APTicket. This was generally more secure than SHSH blobs, and it was believed that it would pose a problem for downgrading from newer firmwares.

Yesterday, iH8sn0w tweeted that he had found a security hold in the APTicket system that will allow downgrading from iOS 5.1. This is great news for anyone that updated to 5.1 accidentally and lost their jailbreak. The downgrade system will work on all A5 devices, and A5X devices once a new firmware is released for them. Stay tuned for more updates regarding this news.

POSTED IN » All
About the author: Freddy Kellison-Linn View all posts by
Freddy is a writer and co-founder of JailbreakNation. He has been working for the site since late 2010. Freddy also develops and manages iPhone Applications on the App Store, most notably SchoolTool and SchoolTool Pro.
  • Zimen

    So does it mean we won’t be needing saved shsh when we downgrade to older version of firmware?

    • vice

       @Zimen No, without shsh you cant downgrade jailbroken iDevice.
       

      • Zimen

         @vice sad….

  • JustinPassfield

    wow where do we get the downgrade???
     

  • Priiyamm

    I have a 5.0.1 shsh blob saved will it work if I update to 5.1 then downgrade back to 5.0.1?

  • Xpois0n

     Untethered Jailbreak for all devices iOS 5.1 (A4, A5, A5X): http://www.dailymotion.com/video/xpkrfb_new-ipad-3-untethered-jailbreak-ios-5-1-iphone-4s-4-3gs-ipad-2_tech