iOS Privilege Escalation (Full Guide)

What is iOS Privilege Escalation?​

In simple terms, Privilege Escalation (PrivEsc) is when an attacker (or researcher) moves from a lower privilege level → higher privilege level on iOS.
Normal app = sandboxed (no access to system files).

Attacker wants = root / kernel access (full control).
This is the backbone of iOS jailbreaks, iOS malware, and many iOS exploits.

Types of Privilege Escalation in iOS​

1. Vertical Privilege Escalation
Gain access to higher-level privileges (e.g., root).
Example: Exploiting a kernel memory corruption bug to break sandbox and run code as root.
2. Horizontal Privilege Escalation
Access other apps or user data without root.
Example: Exploiting an iOS inter-process communication (XPC/IPC) flaw to steal data from another app.

Techniques & Attack Vectors​

Kernel Exploits​

The most powerful PrivEsc.
Example: SockPuppet (CVE-2019-8605) – use-after-free bug in iOS kernel allowed arbitrary code execution with system-level privileges.

Sandbox Escapes​

Each iOS app runs in a sandbox (jail).
Exploit bugs in App Sandbox → escape → system resources.

Entitlement Abuse​

iOS apps use entitlements (special plist permissions).
Misconfigured entitlements = app gets powers it should not have.

Jailbreak Exploits​

Most jailbreak tools (Checkra1n, unc0ver) rely on PrivEsc.
Example: Checkm8 BootROM exploit → permanent jailbreak on A5–A11 devices (can’t be patched by Apple in software).

Abusing System Services​

Attackers exploit daemons (running with higher privileges) through XPC messages, Mach ports, or IOKit drivers.

Real-World Examples​

1. CVE-2016-4657 (Pegasus Spyware)​

WebKit exploit → kernel PrivEsc → full device compromise.
Used in nation-state spyware.

2. CVE-2019-8605 (SockPuppet)​

Used in jailbreaks.
Kernel memory bug → root access.

3. Checkm8 BootROM Exploit​

Found by axi0mX.
Permanent hardware-based PrivEsc → unpatchable on affected iPhones.

Defenses Against Privilege Escalation​

Update iOS regularly (Apple patches PrivEsc bugs quickly).
No Jailbreaking (removes system protections).
MDM Policies – enforce app restrictions in enterprise devices.
Monitor PrivEsc Indicators – unusual system files, unsigned apps, disabled security controls.
Apple Security Features
Code signing (apps must be signed).
Kernel integrity protection.
Secure Enclave (isolates cryptographic keys).

Why It Matters?​

Hackers: Use PrivEsc to install spyware, ransomware, or steal data.
Bug Bounty Hunters: PrivEsc exploits = high payouts .
Researchers: Jailbreaking requires PrivEsc.
Defenders: Detecting PrivEsc attempts = preventing full system compromise.

Summary:
iOS Privilege Escalation is all about breaking Apple’s sandbox & kernel protections. From Pegasus spyware → Jailbreaks → Checkm8, every big iOS hack starts with PrivEsc.