TMA-IOS-4.2
Ensure device is not obviously jailbroken or compromised
Description
This recommendation pertains to inspecting a device for the presence of the most common jailbreak indicator. Profile: Level 1 - End-User Owned Devices, Level 1 - Institutionally-Owned Devices.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
The ways a device is compromised can change over time, thus it may prove to be hard detecting a compromised device. However, there are some indicators that are suspicious and might mean an iOS device is no longer genuine. Suspicious apps are installed on the device > High data usage > The device is hot or overheats > High battery drain > Poor overall performance > Unrecognized calls/texts. For jailbroken devices, the additional checks below can be run: From the Home Screen, swipe down to open Spotlight > Enter Cydia, Sileo, and checkra1n > Confirm every time that Spotlight ... (see benchmark)
How it is fixed
Fix method: Guidance or infrastructure patch
Restore the iOS to a known good state from a trusted computer: iTunes > Connect the iOS device to the computer with a USB cable > your iOS device within iTunes > Restore iPhone/iPad > After restoration, set up as a new device or restore from a known good backup.
Properties
- Operating systems
- Any
- Tags
- iosdevice-settings
- Reference
- CIS Apple iOS 26 Benchmark v1.0.0 - 4.2 Ensure device is not obviously jailbroken or compromised