-
Notifications
You must be signed in to change notification settings - Fork 5
BaconJIT Security Information
This page will just provide some information on the security of BaconJITBridge, and potential risks/how they have been mitigated. This is all mostly just for transparency for those who don't wish to go through my code.
No, it does not (with a small caveat). BaconJITBridge is set up to exclusively allow connections to only 3 trusted websites, as well as localhost. These three websites are https://baconium.dev, https://jessimc.dev, and https://roooot.dev. These are the only sites that the JIT enabler will ever be hosted at (or localhost assuming you're self hosting), and as of writing this it is only currently live at https://baconium.dev/jit. If an untrusted site attempts to connect to BaconJITBridge, it will simply be refused. This means that no other websites will be able to access any potentially sensitive data from your device. This being said, if you install a malicious app on your pc that attempts to connect to BaconJITStreamer over localhost, the connection will be accepted and the app could send data to an arbitrary server. Always be careful when installing anything on your computer!
Always be careful when trusting a computer, as an attacker could potentially read the following:
- Device name
- Model (iPhone14,3 etc.)
- iOS version / build number
- UDID
- Serial number
- IMEI / MEID
- Phone number
- Baseband version
- Disk usage
- Battery info
- Installed profiles
- Installed apps
- Certain app data
- All texts/iMessages sent from your device
- Contacts
- Call history
- Notes
- Safari history/bookmarks
- App data
- Camera roll (all photos and videos)
- Keychain data (passwords you have saved)
This is only what can be accessed completely jailed. Attackers may be able to get even more information if they have an exploit for your iOS version.