iPhone users have yet another screenlock bypass vulnerability to watch out for, according to a new video demonstration that shows how the bug can be exploited to gain unauthorized access to photos and contacts.
The hack reportedly works on iOS version 9.0.1, which Apple released Wednesday, although some people say they are unable to reproduce it. The vulnerability makes it possible for someone who gets even a brief moment with an iPhone to rifle through contacts and photos without entering the password. Here it is in action.
It works by entering an incorrect password four times. Then, immediately after the incorrect password is entered for the fifth time, the attacker holds down the home button before the device can lock the attacker out. The Siri personal assistant pops up and the attacker uses it to bring up the inbuilt clock. The attacker then taps the clock and presses the + icon, giving access to search capabilities. From there, the attacker gets access to iMessage.
Once in iMessage, the attacker has the ability to read, delete, or add contacts, but there's also a way to access photos stored on the device by adding a profile. Other parts of the phone remain off-limits, so the bypass is only partial.
It's not clear yet why so many people report the hack works while others say it doesn't. There may be some sort of configuration setting at play, but so far no one seems to have identified it. At any rate, the partial bypass hack can be prevented by preventing Siri from being accessed from the lock screen. To do this, access settings, choose Touch ID & Passcode, enter the device password, scroll down to "Allow access when locked" and disable it.
reader comments
78