'iBoot' leak may stem from low-level Apple engineer with ties to jailbreaking community

This week's publishing of the "iBoot" source code for iOS 9 can be traced back to a "low-level" Apple employee who shared it with a small group of jailbreaking friends — and may not have wanted it to go beyond that circle, a report claimed on Friday.

The person was encouraged to use their inside access to help the friends out, Motherboard said. On top of iBoot, the employee is said to have taken additional code — which has yet to be widely shared — and distributed all of the material with a group of five people.

"He pulled everything, all sorts of Apple internal tools and whatnot," one friend noted.

Two of the friends said they hadn't planned on the stolen code leaving their group, but that it nevertheless ended up being shared more broadly and hence out of their control.

"I personally never wanted that code to see the light of day. Not out of greed but because of fear of the legal firestorm that would ensue," one person elaborated. "The Apple internal community is really full of curious kids and teens. I knew one day that if those kids got it they'd be dumb enough to push it to GitHub."

They argued that the initial group did its "damnedest" to make sure the code didn't leak until it was already old and less of a threat. Nevertheless, someone shared it with a person outside of the original circle a year after it was stolen, and it began spreading further and further during 2017.

The situation culminated with iBoot's appearance on GitHub. Apple subsequently issued a DMCA takedown, but downplayed the threat, saying that updated iPhones and iPads should be secure.

An anonymous Apple worker told Motherboard the company knew about the iBoot leak before it arrived on GitHub, but wouldn't say when it was discovered.

39 Comments

lkrupp 10521 comments · 19 Years

About 6 years ago

Well, my first question would be how could a “low-level” employee have clearance to access source code, the keys to the kingdom?

anton zuykov 1056 comments · 9 Years

AppleInsider said:

"He pulled everything, all sorts of Apple internal tools and whatnot," one friend noted.
I knew one day that if those kids got it they'd be dumb enough to push it to GitHub."

Git would need to have a flag -pmij that would come with "git push origin". The flag would stand for "put me in jail"

You can't just take away company's code (aka intellectual property potentially worth of billions) and put it out there like that. That is not just petty theft and will result in 10-20 years behind bars easily...and that is without counting the fees/fines and other things Apple will try to sue that person for.

emig647 2446 comments · 20 Years

lkrupp said:

Well, my first question would be how could a “low-level” employee have clearance to access source code, the keys to the kingdom?

I believe they mean "low-level" software engineer. Someone that works on the lower level code close to the kernel.

maestro64 5029 comments · 19 Years

lkrupp said:

Well, my first question would be how could a “low-level” employee have clearance to access source code, the keys to the kingdom?

Yeah that is the Billion $ questions, usually source code access is control to what subsystems you work on, only upper level people would have full access to all the code and code branches. There is more to this store which is not being told.

foggyhill 4767 comments · 10 Years

maestro64 said:

lkrupp said:

Well, my first question would be how could a “low-level” employee have clearance to access source code, the keys to the kingdom?

Yeah that is the Billion $ questions, usually source code access is control to what subsystems you work on, only upper level people would have full access to all the code and code branches. There is more to this store which is not being told.

Low level here obviously means kernel, drivers, firmware , whatever... Has nothing to do with clearance.