Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Major Security Flaw in 2.0.2
- Thread starter greenmymac
- Start date
- Sort by reaction score
Wrong. It doesn't exist on the iPod touch because there is NO EMERGENCY CALL button first. You can't double tap until you get into the Emergency Call area
Thanks for your non-insulting post. I appreciate it : )
For one thing though, the entire iphone software design is in an attempt to be simple and idiot proof. They think out ever user error they can think of to try and prevent it from the software side in attempts to make this the best phone/device on the planet. To do what I'm saying would be soooo simple in comparrison to other software fixes that they have to come up with and is so minor. I mean, the apple laptops actually have a hard-drive that protects itself when its dropped. Apple did that for user hard drive protection incase of accidents. This is on a much smaller scale don't you think?
Plus, its not just user error. Its apples hardware error. According to apple (I asked them believe me), if the hardware in the iphone goes out like a censor or something for some random reason (like a stick of ram or hard drive in a pc), then what do they do? Its the hardwares fault, not the user.... but apple would just replace the entire phone and the data would be lost (unless you paid $$$ to a data recovery place).
If they flip-floped things so that you enter the password on the computer when syncing instead of the phone then the problem would be solved. The apple techs I spoke with completely agreed with me and didn't know why it wasn't setup that way in the first place...
I'm talking about the initial discovery.
A responsible person would report it to Apple and reveal nothing to the community. That way Apple can fix it and there's never actually a risk of it affecting someone negatively. It just so happens that people are far more interested in attention than they are in being responsible.
Apples and oranges. This ain't a scriptable exploit. It's not like MR-perusing evil personae are going on an iPhone theft rampage now that they know they can hack into some.
Just set your home button to something else if you happen to have pointed it to them favorites.
Yeah, sorry - you are correct. However, there isn't an option to change what the double tap of the home button does in the iPod (not that this is relevant to this discussion now, but I thought it was interesting nonetheless)
Not sure why yours wouldn't (maybe something to do with the water damage, maybe you were trying to sync to a different computer?) but I have my iPhone (v1 but latest firmware) set to autolock the screen after 1 minute, password protected, and every time I plug it into my mac it syncs (including offloading photos) without me having to type the passcode to unlock the screen first. I plug it in, the "Sync in progress" screen comes on, it syncs. That's the way it's always worked.
If you do forget the passcode you can reset it by doing a restore in iTunes and regain access to the phone (this is documented in the users guide). That wipes the data, of course, but as I said you should be able to sync to the computer your phone is paired with without the code.
Safari access means you can access other apps
I have 2.02 and Exchange set up and the instructions worked perfectly. After I got to a contact with a URL and opened Safari, I was able to go to the PapiJump scores page and load and play PapiJump while the phone was still locked.
Apparently with the right window.location() javascript (which you could load from your own website once you have Safari), you can navigate to any app. I haven't tried, but you may be able to open the App Store and install your own app on the phone all while the phone is locked.
I have 2.02 and Exchange set up and the instructions worked perfectly. After I got to a contact with a URL and opened Safari, I was able to go to the PapiJump scores page and load and play PapiJump while the phone was still locked.
Apparently with the right window.location() javascript (which you could load from your own website once you have Safari), you can navigate to any app. I haven't tried, but you may be able to open the App Store and install your own app on the phone all while the phone is locked.
The problem here is that the barrier-to-entry is so low. You leave your phone unattended for 30 seconds and someone can get your home phone number, your last 5 recent calls, and read your latest corporate email. Then they set the phone back down and you'll never know.
The problem is what if you have an email with sensitive info like credit card number, pin number, etc.... and now that person who looked at your phone for 30 seconds has all that info and you don't know!
No one is making you jailbreak.
No one would make you install BossPrefs even if you did jailbreak.
No one would make you set BossPrefs to open when you double click the home button even if you did install BossPrefs.
No need to throw unsolicited criticism my way. I was merely posting more info about the bug.
If someone were to say "I'll add this to my list of reason not to buy an iPhone" wouldn't that be upsetting?
Err - who is so foolish to have their PIN, and credit number non-obfuscated in an open email??
Or leave their phone unattended, which was the point I was trying to make in the first post.
What if someone steals.... goes to all the bank websites and clicks forgot password email it to me or for that fact any website with login info and clicks forgot password and since they have access to your email they will have access to website passwords!
Honestly, I don't want to make a huge deal about this. But.... this is something I discovered. And I'm not upset that you posted it first, greenmymac, or that it's being publicized all over the internet-- TUAW, Gizmodo, etc. What bothers me a little is that you're taking credit for the discovery. Not only that, you've plagiarized my own submission basically word-for-word.
Allow me to explain:
I figured this out a couple nights ago, and called Apple about it to point it out and see if there was a temporary fix (they suggested setting the home button to iPod controls). I also filed a bug report via Apple's Developer Bug Reporter (I'm signed up as a free iPhone developer). A few hours later, I sent that bug report in full to both MacRumors (via the news submission form) and TUAW (using their Tips page). The first post in this page is, word for word, a portion of that bug report. If it really comes to that, I can submit screenshots/Apple problem ID numbers/my follow-up email from Apple (with times BEFORE this thread's first post), etc. as proof, but I hope this won't be necessary. I'm not looking to start a flame war here, just don't like it when someone plagiarizes me so transparently. Greenmymac: I'm not sure if you got ahold of this via MacRumors, TUAW, or (god forbid) Apple, but was it REALLY necessary to claim the discovery as your own?
According to the ADC email I received, this was already a known issue. Nevertheless, I AM happy about how much attention this has gotten, hopefully that will spur Apple into putting out a fix sooner rather than later. I actually submitted it anonymously in the first place, so I wasn't exactly looking for credit. But it doesn't feel right to let greenmymac post this as if it were HIS (or her) discovery, uncontested.
Allow me to explain:
I figured this out a couple nights ago, and called Apple about it to point it out and see if there was a temporary fix (they suggested setting the home button to iPod controls). I also filed a bug report via Apple's Developer Bug Reporter (I'm signed up as a free iPhone developer). A few hours later, I sent that bug report in full to both MacRumors (via the news submission form) and TUAW (using their Tips page). The first post in this page is, word for word, a portion of that bug report. If it really comes to that, I can submit screenshots/Apple problem ID numbers/my follow-up email from Apple (with times BEFORE this thread's first post), etc. as proof, but I hope this won't be necessary. I'm not looking to start a flame war here, just don't like it when someone plagiarizes me so transparently. Greenmymac: I'm not sure if you got ahold of this via MacRumors, TUAW, or (god forbid) Apple, but was it REALLY necessary to claim the discovery as your own?
According to the ADC email I received, this was already a known issue. Nevertheless, I AM happy about how much attention this has gotten, hopefully that will spur Apple into putting out a fix sooner rather than later. I actually submitted it anonymously in the first place, so I wasn't exactly looking for credit. But it doesn't feel right to let greenmymac post this as if it were HIS (or her) discovery, uncontested.
If you bank with a website that will email you your password with the click of a button without asking for other authentication info, you deserve it.
Oh, do post screenshots. I would thoroughly enjoy them.
He's my friend, and honestly, if I were him, I'd be livid. Even if you're from TUAW or MacRumors, or hell, even Apple, you had no right to take all the credit for this. He was the first person to find it, and he should have the credit. I have even more proof.
Chax history, posted on August 26th at 6:58 PM MST.
HE discovered this, and HE should have the credit, not GreenyMac.
Pics or it didn't happen
You are making a pretty bold claim for somebody who isn't all that active here as a member (only one post), and doesn't have any real connection between your reports and this thread.
Pics or it didn't happen
You are making a pretty bold claim for somebody who isn't all that active here as a member, and doesn't have any real connection between your reports and this thread.
Or you could look at my post right before yours...
Which wasn't there when I typed that, and even still there is no proof that you are talking with him, and I would hardly call that proof. And it still doesn't show how this thread's OP got the info.
Im sorry you feel im taking all the credit but I authentically found this yesterday on my iPhone and I searched the forums thoroughly before posting to make sure someone hadn't already posted about this exact issue
Uh, because if GreenyMac was my friend who sent me that, I'd be calling him out, right? Or wait, that might be stupid!
If you're hard pressed to believe me even still:
Unless GreenyMac decided to have an extremely similar username on iChat and I'm friends with him this is more proof than needed.
How is that proof? So I guess what your saying is I hacked into your computer and watched you and your iChat conversation?
No, it's proof that he found it before you did, and he's currently taking sreenshots proving that it's WORD FOR WORD.