How To Tell If Your Phone Has Been Jailbroken

For iOS, check for Cydia, Sileo, or Zebra apps (jailbreak package managers) in Settings → General → iPhone Storage. Look for suspicious ssh keys or rock.json files using a computer. For Android, use the “Verify Root” app or check for Magisk/SuperSU in Settings → Applications. Review system apps in Settings → Apps for unknown entries. The definitive test: if you can read system partition files without adb root access (Linux/Mac), or if you see warning messages when attempting security checks, your device is likely jailbroken/rooted.

Why Unauthorized Jailbreaks Matter

When someone gains root or jailbreak access to your device, they can:

Install keyloggers and spyware that capture passwords, messages, and calls
Modify system apps or install malicious alternatives
Bypass biometric and PIN authentication
Access encrypted data stored on the device
Intercept network traffic through man-in-the-middle attacks

Detecting an unauthorized jailbreak quickly allows you to wipe the device and secure your accounts before significant damage occurs.

Detecting iOS Jailbreaks

iOS jailbreaks typically leave observable artifacts. Check these indicators systematically.

1. Presence of Package Manager Apps

Cydia, Sileo, Zebra, or Substitute are package managers installed during jailbreaks. Search your device for these apps:

# List all installed apps on iOS (requires macOS with Xcode)
xcrun simctl list devices available

If you find Cydia, Sileo, or similar apps you never installed, your device may be jailbroken. On a non-jailbroken device, these package managers cannot exist because the sandbox prevents their installation.

2. Check for Suspicious Files and Directories

Jailbroken devices have additional filesystem paths. Check for these directories:

# Common jailbreak-related paths on iOS
ls -la /Applications/Cydia.app
ls -la /Library/MobileSubstrate/MobileSubstrate.dylib
ls -la /bin/bash
ls -la /usr/sbin/sshd
ls -la /etc/apt
ls -la /private/var/lib/apt/

The presence of /bin/bash (instead of /bin/sh) or package management directories indicates a jailbreak.

3. Verify Sandbox Integrity

On a non-jailbroken device, certain system calls behave differently. This Swift code checks for common jailbreak indicators:

import Foundation

class JailbreakDetector {

    static func isJailbroken() -> Bool {
        let suspiciousPaths = [
            "/Applications/Cydia.app",
            "/Library/MobileSubstrate/MobileSubstrate.dylib",
            "/bin/bash",
            "/usr/sbin/sshd",
            "/etc/apt",
            "/private/var/lib/apt/",
            "/private/var/Users/",
            "/private/var/stash",
            "/private/var/mobile/Library/SBSettings/Themes",
            "/System/Library/LaunchDaemons/com.ikey.bbot.plist",
            "/System/Library/LaunchDaemons/com.saurik.Cydia.Startup.plist"
        ]

        for path in suspiciousPaths {
            if FileManager.default.fileExists(atPath: path) {
                return true
            }
        }

        // Check if app can write outside sandbox
        let testPath = "/private/jailbreak_test.txt"
        do {
            try "test".write(toFile: testPath, atomically: true, encoding: .utf8)
            try FileManager.default.removeItem(atPath: testPath)
            return true
        } catch {
            // Expected on non-jailbroken device
        }

        // Check for symbolic links
        let symlinks = ["/Applications", "/var/stash/Library/Ringtones"]
        for link in symlinks {
            var isDirectory: ObjCBool = false
            if FileManager.default.fileExists(atPath: link, isDirectory: &isDirectory) {
                if !isDirectory.boolValue {
                    return true
                }
            }
        }

        return false
    }
}

// Usage
if JailbreakDetector.isJailbroken() {
    print("WARNING: Device appears to be jailbroken")
}

4. Check for SSH Connections and Open Ports

Unauthorized jailbreaks often leave SSH daemons running. Verify open network listeners:

# On the device, check listening ports
netstat -an | grep LISTEN

# Look for SSH on port 22
lsof -i :22

Unrecognized SSH services indicate a potential compromise.

5. Examine Installed Profiles

Jailbreaks sometimes install configuration profiles for malicious purposes:

Go to Settings > General > VPN & Device Management
Look for unknown profiles installed without your knowledge

Remove any profiles you do not recognize.

Detecting Android Rooting

Android rooting modifies the system partition to grant superuser access. Detection requires checking for root binaries and Superuser apps.

1. Check for Root Management Apps

Apps like SuperSU, Magisk Manager, or KingRoot indicate root access:

// Android detection using PackageManager
fun isRooted(): Boolean {
    val rootApps = listOf(
        "com.topjohnwu.magisk",
        "com.noshufou.android.su.elite",
        "com.noshufou.android.su",
        "com.koushikdutta.superuser",
        "com.thirdparty.superuser",
        "com.yellowes.su",
        "com.kingroot.kinguser",
        "com.kingo.root",
        "com.smedialink.oneclickroot",
        "com.zhiqupk.root.global"
    )

    val packageManager = appContext.packageManager

    for (packageName in rootApps) {
        try {
            packageManager.getPackageInfo(packageName, 0)
            return true
        } catch (e: PackageManager.NameNotFoundException) {
            // Not found, continue
        }
    }

    return false
}

2. Verify Root Binaries Exist

Rooted devices have binaries in system directories that normal devices lack:

# Check for common root binaries
ls -la /system/app/Superuser.apk
ls -la /sbin/su
ls -la /system/bin/su
ls -la /system/xbin/su
ls -la /system/xbin/xbin
ls -la /system/xbin/busybox

The presence of /system/xbin/su or /system/bin/su strongly indicates rooting.

3. Test Root Access

Attempt to execute a privileged command:

fun checkRootAccess(): Boolean {
    val process = Runtime.getRuntime().exec("su -c id")
    val output = process.inputStream.bufferedReader().readText()
    val exitCode = process.waitFor()

    return exitCode == 0 && output.contains("uid=0")
}

If this returns root (uid=0), the device is rooted.

4. Detect Magisk Hide

Magisk Hide hides root from specific apps. Detection requires more advanced techniques:

fun detectMagisk(): Boolean {
    val magiskPaths = listOf(
        "/sbin/.magisk",
        "/sbin/.core",
        "/data/adb/magisk",
        "/data/adb/magisk.img"
    )

    for (path in magiskPaths) {
        if (File(path).exists()) {
            return true
        }
    }

    // Check for hidden magisk mount
    val mounts = File("/proc/self/mounts").readText()
    if (mounts.contains("magisk")) {
        return true
    }

    return false
}

5. Verify System Partition Writable

Normal Android devices have read-only system partitions. Rooted devices can remount as writable:

# Check if /system is mounted read-only
mount | grep /system

# Attempt to test write access (requires root)
mount -o rw,remount /system
echo "test" > /system/test_file

What To Do If You Detect Unauthorized Access

If you discover your phone has been jailbroken or rooted without consent:

Disconnect from networks: Disable Wi-Fi and cellular to prevent data exfiltration
Backup essential data carefully: Only trust data that predates the compromise
Factory reset the device: This removes jailbreak artifacts and returns the device to a clean state
Change critical passwords: Prioritize email, banking, and social media accounts
Enable two-factor authentication: On all important accounts
Check for unauthorized access: Review account login history for suspicious activity

For iOS, restore through iTunes or Finder rather than simply erasing, to ensure a clean firmware reinstall.

Prevention Strategies

Reduce the risk of unauthorized jailbreaking:

Keep your device with you and never leave it unattended in public
Use strong passcodes and biometric authentication
Enable Find My iPhone or Find My Device
Avoid sideloading apps from untrusted sources
Keep iOS and Android updated with latest security patches
Disable developer modes and USB debugging when not needed

Built by theluckystrike — More at zovo.one