iOS 7 Lock Screen Vulnerability Discovered

http://techcrunch.com/2013/09/19/ios-7-lock-screen-vulnerability-discovered-gives-access-to-photos-and-social-sharing/

by cramforce • 13 years ago

52 52 13 years ago

techcrunch.com

libraryatnight2• 13 years ago

Here's the Forbes link for anyone who doesn't like giving techcrunch hits:

http://www.forbes.com/sites/andygreenberg/2013/09/19/ios-7-b...

MPetitt• 13 years ago

Is there something shady I don't know about techcrunch?

libraryatnight2• 13 years ago

I don't know about shady, I just know a lot of people don't care for them or the way they present things. I'd also just read the Forbe's article and then clicked through to techcrunch and realized that's what they were reporting from.

roschdal• 13 years ago

"Note that this vulnerability is incredibly easy to prevent for now. Just visit Settings>Control Center and toggle off ‘Access on Lock Screen’ to patch it up."

state• 13 years ago

"The discovery was made by Jose Rodriguez, a soldier in Spain’s Canary Islands, who has a history of discovering these tricky bypass methods. His secret? Plenty of time waiting in cars in his former job as a driver for government officials."

I love that. It's not a 'security researcher', it's just some guy messing around with his phone.

denzil_correa• 13 years ago

It's not a 'security researcher', it's just some guy messing around with his phone.

And that's exactly how a vulnerability seeker should behave - messing around!

jonknee3• 13 years ago

Seems like Apple should toss him a few bucks to play with the betas.

phoboslab• 13 years ago

There's so much happening and accessible on a "locked" iPhone that it's not surprising something may go wrong. Securing a phone that can't do anything when locked would be much easier.

Reminded me of this Win95 login bypass: http://i.imgur.com/rG0p0b2.gif

nextstep• 13 years ago

It's hard to get the timing right on the cancel/double-tap home button step.

neon_electro• 13 years ago

I don't know if it's because my iPhone 4's slower, but I found it relatively easy to do.

r00fus2• 13 years ago

I tried numerous times with iPhone5 on iOS7 and I can't reproduce it. I wonder what the timing issue is. I tried immieately double-pressing home after cancelling the poweroff, and then delaying it. Nothing worked.

GuiA• 13 years ago

You have to douple tap the home button a split second after having tapped "Cancel". It took me a few tries, but it works.

r00fus2• 13 years ago

My passcode lock is set to immediately. After changing it to "5 min" it worked. Changing it back made it impossible again. So that's another way to avoid the vulnerability (along with turning off control center access from lockscreen).

Regardless, I'm sure this'll be fixed shortly and glad this guy found the vulnerability so soon!

shalander3• 13 years ago

I can see how reproducing could potentially be tricky for some, that said, I was able to reproduce this almost instantly. I wonder if I should bother restoring back prior to iOS 7 or just wait for the patch? Hmmm....

zwily• 13 years ago

Just disable Control Center on the lock screen. Seems much easier than downgrading iOS...

shalander3• 13 years ago

Yeah but... puts on tinfoil hat What if the NSA and stuff?! :-P

Seriously though, Control Center is probably a good stop-gap, though the bigger question is probably how quickly Apple will try to patch this.

twodayslate• 13 years ago

You can't downgrade.

shalander3• 13 years ago

If you have a full back-up of your iPhone prior to upgrading you can do a full system restore. This is what I was referring to.

superuser2• 13 years ago

In iOS 6, the default configuration allowed anyone to send texts (and I think emails) from your accounts by dictating them to Siri through the lock screen.

No one seemed to think this was a big deal, but there was certainly potential for abuse. Security of incoming texts is more important, but being able to send a fraudulent iMessage is definitely a problem for kids who like messing with each other's emotions...

MmeMANET• 13 years ago

unsurprising.

eridius• 13 years ago

To clarify: this doesn't actually give anyone free access to your phone. As near as I can tell, all it lets them do is access your camera roll, and share items from it using the share panel. They can also see what your recent apps list is, but they can't actually access any of them (besides the camera).

partyanimal4• 13 years ago

Yeah, it's not like the hundreds of vulnerabilities you can find on Android phones. Here's the latest.

"Firefox For Android Can Be Tricked Into Automatically Downloading And Executing Malicious Code"

http://www.androidpolice.com/2013/09/11/security-firefox-for...

jonknee3• 13 years ago

Alternate headline... "Firefox For Android can download files". The standard UI comes up as it would for any app install.

McPants2• 13 years ago

That's not exactly a fair comparison, Firefox is a third party app whereas this lock screen vulnerability is part of iOS itself.

yapcguy• 13 years ago

One photo on the camera roll is too much.

Biometric identifiers up next in 3...2...

reiichiroh• 13 years ago

Set passcode to appear "immediately" -- if you set it for 1 min/5 min/15 min/1 hour/4 hours, then this "vulnerability" really isn't one.

jacalata• 13 years ago

The writer clarifies in the comments that yes, he had the passcode set to 'immediately' to repro this.

NSMeta• 13 years ago

Tried this with both "immediately" and 15 min on iPad Mini. Reproduced it every time.

As a side note, one can use this bug to access contacts list and send email on behalf of the owner (via share menu in photo stream).

Edit:

Just found out that I can tweet, post to facebook and send email just by using Siri (if that setting is enabled). Although, this might be the correct behavior.

benologist• 13 years ago

Rewording of http://www.forbes.com/sites/andygreenberg/2013/09/19/ios-7-b...

gdonelli• 13 years ago

AGAIN! This is probably the 7th time?

bigd• 13 years ago

This remind me of the "souvenir d'italie": http://www.youtube.com/watch?v=UPXuIirf8Ow

then post on victim facebook for great fun

MichaelGG• 13 years ago

At least the iOS7 lock screen seems useful. The #1 use of my phone is as a music player. Android somehow thinks it should only show media controls while I'm playing music, and for a minute or two after I put it on pause. FFS, just make my entire music library accessible and always on the lock screen.

Between that, and having maps auto-unlock if you're in nav-mode -- that'd solve about every dangerous car-phone situation I run into.

keeperofdakeys3• 13 years ago

The latest android version has lock screen widgets, which you can use to put a permanent notification up for.

Also, using Navigation instead of Maps keeps the screen unlocked, which may be more handy depending on what you are doing.

scott_karana4• 13 years ago

There is no longer a "Navigation" app: it's been merged into the new Maps, which loses a lot of functionality.

Not sure whether or not it prevents screen locking.

scott_s3• 13 years ago

I think these "vulnerabilities" are silly. The lockscreen on the phone is the equivalent of a screen door: it's meant to keep the bugs out, and to signal to the outside world, "Hey, this is a closed door, behave appropriately." But no one is going to be surprised if burglars are able to get past it.

Miyamoto• 13 years ago

Do you have a password protected computer? Like a computer, a phone can have sensitive information. For many, such as my wife and sister, a phone is their computer. They put everything on it. A lock screen is a no different than any other password prompt you encounter. They're passwords. Passwords are not silly.

scott_s3• 13 years ago

No, I do not, for the same reason. If someone gets physical access to a device, it is compromised.

anfedorov• 13 years ago

It doesn't have to be a screen door, and as far as I understand, it's not intended to be with iOS 7. The phone will not let you sync with an unrecognized external device unless you unlock it, and will stop you from brute forcing the passphrase, as well. Unless you physically take apart the device to remove the flash storage, I don't think there's a way to access the photos on it.

smrtinsert• 13 years ago

Impossible, Apple releases beautiful features that are flawless and have turned this phone into the Samsung and Android killer that everyone was waiting for. It's 64 bit!

iOS 7 Lock Screen Vulnerability Discovered

Related Stories