Second Lock Screen Bypass in iOS 6.1 Documented

Apple priorities - stop innovation from jailbreak community then fix security issues

This method allows access to the photos on the phone when hooked up to a computer? That's not news you can always do that, even with a passcode. Smebody posted a complaint bout it on the iPhone forum and everyone criticized the poster for actually wanting to put private photos on their camera roll.

Radio said:

Apple priorities - stop innovation from jailbreak community then fix security issues

Click to expand...

The exploits used by jailbreakers ARE security issues.

I thought if you had physical access to the phone.....then you can always get data off it.... regardless of whether it has a passcode lock or not?

Not through iTunes....but using any number of 3rd party apps that can see the data on the phone.

-Kevin

dave420 said:

This method allows access to the photos on the phone when hooked up to a computer? That's not news you can always do that, even with a passcode. Smebody posted a complaint bout it on the iPhone forum and everyone criticized the poster for actually wanting to put private photos on their camera roll.

Click to expand...

kbmb said:

I thought if you had physical access to the phone.....then you can always get data off it.... regardless of whether it has a passcode lock or not?

Not through iTunes....but using any number of 3rd party apps that can see the data on the phone.

-Kevin

Click to expand...

When an iOS device that has been locked with a passcode is connect to a computer that it has never been connected to before, it will not let the computer access any information on the device. The device must be locked so that the passcode is needed to unlock it. Once you connect the device to a computer when it is unlocked, that computer becomes authorized to iOS to allow it to browse the device's contents. No third party utility can get around this lockout, neither can a computer's PTP access.

No doubt a serious issue, yet there's something pretty amusing to me about the steps required to get past the lockscreen (not to mention what must have been done in order to discover the bug in the first place).

iOS 6 is such a s*** update.

extricated said:

No doubt a serious issue, yet there's something pretty amusing to me about the steps required to get past the lockscreen (not to mention what must have been done in order to discover the bug in the first place).

Click to expand...

Some people have way too much time. Also, does this only work if you have a simple passcode set?

Intell said:

When an iOS device that has been locked with a passcode is connect to a computer that it has never been connected to before, it will not let the computer access any information on the device. The device must be locked so that the passcode is needed to unlock it. Once you connect the device to a computer when it is unlocked, that computer becomes authorized to iOS to allow it to browse the device's contents. No third party utility can get around this lockout, neither can a computer's PTP access.

Click to expand...

Thanks for the info!

-Kevin

I really want to know how people just happen to stumble upon this stuff. It seems almost rediculous when you think about it.

These guys really have way too much time on their hands...

This is why Apple (and other tech companies) have to hire hackers and people who like to spend time trying this stuff. The reason why these exploits exist is that the programmers program for the way people are supposed to use a device, NOT the way someone intends to use it to circumvent security. You need to have people who are solely looking to crack code or find some obscure exploit somewhere in the emergency dialer....

I used to play shooters for PC/Xbox. Three days after a release, you would see people finding glitches, doing stuff the devs never intended anyone to do. Why don't you just hire these freaks and let them find all this stuff. That would amount to a more secure and better product.

If someone has gained physical access to my iDevice to attempt to exploit a security vulnerability, all of my other security practices have failed.

agitoTech said:

If someone has gained physical access to my iDevice to attempt to exploit a security vulnerability, all of my other security practices have failed.

Click to expand...

This. And this is also why the security holes used by the jailbreak are irrelevant.

furi0usbee said:

This is why Apple (and other tech companies) have to hire hackers and people who like to spend time trying this stuff. The reason why these exploits exist is that the programmers program for the way people are supposed to use a device, NOT the way someone intends to use it to circumvent security. You need to have people who are solely looking to crack code or find some obscure exploit somewhere in the emergency dialer....

I used to play shooters for PC/Xbox. Three days after a release, you would see people finding glitches, doing stuff the devs never intended anyone to do. Why don't you just hire these freaks and let them find all this stuff. That would amount to a more secure and better product.

Click to expand...

Hiring "hackers" is fine in principle. In reality, 99% of the "exploits" found within 3 days of a game launching are most likely revealed by the QA guys who tested the game. Quite often, unless a bug will cause the game to fail a TRC or TCR check, the developers just don't bother. This is largely because of a marketing department who have to meet financial goals rather than quality goals.

I know we're the ones who write spoiler guides for everything ever released, too.

/ex-Quality Assurance peon

agitoTech said:

If someone has gained physical access to my iDevice to attempt to exploit a security vulnerability, all of my other security practices have failed.

Click to expand...

Exactly they must first get physical access to your iPhone. So first line of defence is keep a close watch on your phone. Know where it is at all times. Keep it physically secure.

agitoTech said:

If someone has gained physical access to my iDevice to attempt to exploit a security vulnerability, all of my other security practices have failed.

Click to expand...

Wait, so, if you lose your phone by accident; then you just say oh well, any private data I have on it is fair game and that is okay? Then why even have a passcode on it if it can just be hacked and in your words, if someone has physical access to the device then your data is fair game.

I do not see that logic. I for one would like to have the confidence that if someone had access to my device then at the most I have lost the device, easily replaced and I did not lose private data that someone can use for purposes not so easily replaced.

Physical access is not your second line of defence, it is your first line, your second line is rock solid data security which Apple has been failing at recently.

kbmb said:

I thought if you had physical access to the phone.....then you can always get data off it.... regardless of whether it has a passcode lock or not?

Not through iTunes....but using any number of 3rd party apps that can see the data on the phone.

-Kevin

Click to expand...

Not when there is a passcode on it. When there is a passcode, the phone won't mount as a 'camera' like it can unlocked, and apps like iExplorer cannot access the drive

lunaoso said:

I really want to know how people just happen to stumble upon this stuff. It seems almost rediculous when you think about it.

Click to expand...

Not nearly as "rediculous" as writing about the "hard drive" in a device that has none.

marc11 said:

Wait, so, if you lose your phone by accident; then you just say oh well, any private data I have on it is fair game and that is okay? Then why even have a passcode on it if it can just be hacked and in your words, if someone has physical access to the device then your data is fair game.

Click to expand...

No, I lose my phone I boot up my machine, then trace it on icloud, and erase it if its in a location that I know isn't where I lost it.

Very simple.

If apple is failing at security lately, what does the SIII root access bug (now patched) say? I'd say root access is far more serious than access to my pictures and contacts...

Also, you're putting words in that user's mouth, and I'm sure he wouldn't appreciate it.

Great! another way for my girlfriend to gain access to my phone >_>

good thing I have nothing to hide, but it's annoying when she re-arranges my bloody icons in groups of colors - I then have to spend hours putting everything back in their correct places cause I have OCD like that >_<

NT1440 said:

No, I lose my phone I boot up my machine, then trace it on icloud, and erase it if its in a location that I know isn't where I lost it.

Very simple.

If apple is failing at security lately, what does the SIII root access bug (now patched) say? I'd say root access is far more serious than access to my pictures and contacts...

Also, you're putting words in that user's mouth, and I'm sure he wouldn't appreciate it.

Click to expand...

I didn't put words in anyones mouth, he said them. I am sure he is old enough to speak for himself and doesn't need you to speak for him....isn't that the same as putting words in his mouth? Double standard much?

Let us leave Android out of an iOS discussion for once, huh? Man, this site and its Android paranoia....every Apple fault has to be balanced with an Android fault for some reason.

As for using Find my iPhone, we all know that is so easy to defeat, it isn't hard to defeat it and you are still giving hackers enough time to get your device, hack into and get your data.

The point is, Apple needs to step up and close these security holes. There is no defending Apple on this; regardless if other devices have security holes or not, we OWN Apple Devices, I could give a rats tail how easy it is to root an SIII when someone gets my iPhone.

marc11 said:

As for using Find my iPhone, we all know that is so easy to defeat, it isn't hard to defeat it and you are still giving hackers enough time to get your device, hack into and get your data.

The point is, Apple needs to step up and close these security holes. There is no defending Apple on this; regardless if other devices have security holes or not, we OWN Apple Devices, I could give a rats tail how easy it is to root an SIII when someone gets my iPhone.

Click to expand...

I can tell from the underlined that you don't actually understand software development. Hackers? Really?

Find me one OS on the planet that doesn't have a security hole somewhere in it. This is a game of patch a hole, find 2 others. Software is not a cut and dry field.