# MA-704.082018: MyCERT Advisory - New Iphone Jailbreak Tool

**Date:** 23 Aug 2018  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-704.082018  
**Advisory ID:** MA-704.082018

---

**1.0 Introduction**
The latest jailbreak tool for iPhone named Electra has been released on 6th July 2018. This tool has the capability to gain privilege access that previously restricted by Apple on iPhoneï¿½s iOS. This tethered jailbreak tool compatible with 11.2 until 11.3.1.
**2.0 Impact**
ï¿½ Invalidate the warranty for the iPhone.
ï¿½ Can cause instability and abnormality in device functionality.
ï¿½ Can cause damage to the hardware due to alteration on device functionality and performance.
ï¿½ Device exposed to potential malware infection, bad third-party application and endanger user privacy and sensitive information.
ï¿½ Jailbreaking may remove the security layers implemented in iPhone devices.
In summary, the jailbreaking enables the user to perform:
ï¿½ Privilege escalation to unlock system, application and hardware configuration.
ï¿½ To install third-party applications that are not available in the Apple App Store.
ï¿½ Tweaking system configuration and hardware of the iPhone devices.
Figure 3.4: Brief device information and menu available in Cydia including package search tool.
**3.0 Affected Product*Product Version Platform**
Apple iPhone 11.2.1 until 11.3.1 iOS
**4.0 Recommendations**
4.1. Users are advised to take the following preventive measures to protect their phone if their phone has been jailbroken without their knowledge and consent:
> 1. Immediately switch off the handphone network data.
> 2. Immediately reboot the phone.
> 3. Delete and uninstall unknown app that you never use.
> 4. Change your online account password.
> 5. Change your passcode to access to your device.
> 6. If you think your phone has been tampered physically and jailbroken without consent, report the incident to [[email protected]](/cdn-cgi/l/email-protection#e5869c878097dcdcdca5869c87809796808690978c919ccb889c) for MyCERT incident response.
> 7. Users may forward to Cyber999 further information, file and data associating to the incident for further analysis.
4.2. General best practice for smartphone users:
> 1. Verify an app's permission before installing it, for example, online banking app should not require access to camera, microphone and SMS permission.
> 2. Do not click on adware or suspicious URL sent through SMS/messaging services. Malicious program could be attached to collect user's information.
> 3. Verify given URLs with the official financial institution or law enforcement agency website. On mobile, site URL may appears differently from desktop browser, make sure to verify it too.
> 4. Always run a reputable anti-virus on your smartphone/mobile devices, and keep it up to date regularly.
> 5. Don't use public Wi-Fi networks for bank transactions and turn off Bluetooth connection when not in use. These can be open windows for eavesdroppers intercepting the transaction or installing spyware and other malware on user's smartphone/tablet.
> 6. Update the operating system and applications on smartphone/tablet, including the browser, in order to avoid any malicious exploits of security holes in out-dates versions.
> 7. Do not root or otherwise 'Jailbreak' your phone. This give administrator privilege to access the device filesystem and malicious app could take advantage.
> 8. Avoid side loading (installing from non-official sources) when you can. If you do install Android software from other source than the official app store, be sure that it is coming from a reputable source.
> 9. Please ensure to turn off the ï¿½Unknown Sourceï¿½ option in the Security Settings page.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#e98a908b8c9bd0d0d0a98a908b8c9b9a8c8a9c9b809d90c78490) or [[email protected]](/cdn-cgi/l/email-protection#aec3d7cdcbdcdaeec3d7cdcbdcda80c1dcc980c3d7)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- <https://www.mycert.org.my/portal/advisory?id=MA-416.092014>