Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Major Security Flaw in 2.0.2
- Thread starter greenmymac
- Start date
- Sort by reaction score
You can really dig into the phone with this, I followed the steps above first then did some exploring. I clicked on a contact in favorites, then clicked on the sms button. Once in sms I backed out of their text log and had access to all my text's. I picked a text I knew had a link in it, that got me to my Safari app. I could surf anywhere I wanted. I picked a contact with an address and had access to Maps and GPS. An email address get's you into mail. I'm sure there is more. Damn talk about dropping the ball.
Hmmm... A strange game. The only winning move is not to play. How about a nice game of chess?
About security
While we're on the subject of security, has anyone tried accessing the phone data as follows:
- connect phone (while locked) to a new computer and iTunes
- backup iPhone
If iTunes allows to sync the iPhone with the computer without requiring the passcode to unlock the phone, then ALL the data on the phone is backed up to the computer and can easily be accessed by anyone using the computer.
Not in a position to try this out myself, but I think it just might work... iPhone never asks me for the passcode when I connect it to the computer.
While we're on the subject of security, has anyone tried accessing the phone data as follows:
- connect phone (while locked) to a new computer and iTunes
- backup iPhone
If iTunes allows to sync the iPhone with the computer without requiring the passcode to unlock the phone, then ALL the data on the phone is backed up to the computer and can easily be accessed by anyone using the computer.
Not in a position to try this out myself, but I think it just might work... iPhone never asks me for the passcode when I connect it to the computer.
I have sent it off to Apple Feedback, Apple iTunes Support, Apple Mobile Me Support, TUAW, Someone at Apple is bound to see this!
I think all the backup info is encrypted!
1.0 didn't have the double tap home button option
So...
A stranger can have access to the phone app and safari.
... the only two applications that we're all having problems with.
yawn
A stranger can have access to the phone app and safari.
... the only two applications that we're all having problems with.
yawn
No they have access to Safari, iPhone app, Contacts, Email, pretty serious to me
I have Exchange setup on my iphone which forces you to set a passcode and I can verify that there is no security hole.
OK, let me re-phrase myself: it's been there since the "Home Button Double-clicking" option
Anyway WOW
If it is encrypted, then that's a new feature in 2.0 or iTunes 7 since back when I was in 1.1.3, I could easily access my SMS and calendar from the SQLITE databases that are backed up on my computer. Of course, it takes some time trying to guess which file is which database, but once that trivial task is done, it's very easy to see the data.
Don't have time to check this now, but I still doubt it's encrypted in any way.
I wonder what Apple's problem is... Steve jobs has to be sick cause normally this **** would not fly
Uh, doesn't the apple logo have a hole for a reason?
I also wonder how get Macrumors to front page this!
Macworld has an article about this now, referencing this thread as to pointing it out:
Macworld Link
And as it states in their article, an Apple spokesperson in London had no knowledge of this flaw, so this very well might be the first that they have heard of it, if so, expect this to be fixed in 2.1, or maybe an unplanned release of 2.0.3 directed only at this problem.
Macworld Link
And as it states in their article, an Apple spokesperson in London had no knowledge of this flaw, so this very well might be the first that they have heard of it, if so, expect this to be fixed in 2.1, or maybe an unplanned release of 2.0.3 directed only at this problem.
Wirelessly posted (iPhone: Mozilla/5.0 (iPhone; U; CPU iPhone OS 2_0_2 like Mac OS X; en-us) AppleWebKit/525.18.1 (KHTML, like Gecko) Version/3.1.1 Mobile/5C1 Safari/525.20)
Pretty ironic, considering all the hoops developers have to jump through to stay within Apple's SDK boundaries, insuring nothing they do compromises the phone. Apple obviously doesn't need any help from devs; the iPhone is perfectly capable of compromising itself.
Pretty ironic, considering all the hoops developers have to jump through to stay within Apple's SDK boundaries, insuring nothing they do compromises the phone. Apple obviously doesn't need any help from devs; the iPhone is perfectly capable of compromising itself.