Jailbreak

How it works

iOS runs every app inside a sandbox, signed by Apple, with no access to the underlying file system. A jailbreak exploits a vulnerability in the kernel or the boot chain to disable those checks. Once it's done, the user can install apps from third-party stores like Cydia or Sileo, run code as root and change system files.

Rooting does the same job on Android: it unlocks the bootloader or patches the boot image (Magisk is the usual tool) to grant superuser rights. Modern versions of both systems make this harder. Apple hasn't left a public untethered jailbreak for a current iOS release since iOS 14, and Google's Play Integrity API flags rooted devices to any app that asks. But older devices and delayed updates keep the problem alive in most fleets.

Detection relies on indicators rather than a single flag: the presence of known files or binaries, writable system partitions, failed integrity attestations, or a kernel that reports the wrong state. No check is perfect, so MDM vendors combine several.

Why it matters for a fleet

A jailbroken phone is a phone where nothing the OS promises still holds. Passcode enforcement, app sandboxing, encryption of the data protection classes, the guarantee that an app can't read another app's data: all of it can be bypassed. Malware written for jailbroken devices (KeyRaider stole more than 225,000 Apple accounts in 2015 this way) targets exactly that gap.

For you as an admin, the practical consequence is simple. Any policy you push to that device is unverifiable. The MDM agent itself can be tampered with. And if the device holds customer data or connects to your VPN, you can't demonstrate to an auditor that it was protected. ENISA lists compromised endpoints among the top mobile threats year after year for that reason.

Users rarely jailbreak company phones on purpose. It's usually a BYOD device that was modified years ago, or a second-hand Android bought with root already enabled.

How Appaloosa handles it

Appaloosa checks the integrity state of every enrolled device and reports jailbroken or rooted devices in the console, with the date the state changed. You decide what happens next through a compliance policy: notify the user, block access to managed apps, or remove the work data with a selective wipe. Rooted devices can also be refused at enrollment so they never enter the fleet in the first place.

The check runs on iOS, iPadOS and Android, and the result feeds into the same device inventory you use for the rest of your mobile device management. So a jailbreak shows up next to the OS version and the last check-in, not in a separate tool you'd have to remember to open.