iOS 4.1 Security Issue - Bypassing the Lock Screen to Make Calls

Cannot reproduce issue on 4.2 B3.

PNutts said:

Whilst in the phone app I held down the home button and entered voice control mode where I started a song. What other interesting things can we do?

Click to expand...

That's what I did. Voice Control has full functionality, so calling people or dialing numbers is also possible.

This also allows you to view their photos. When in contacts tap 'share contact' that will bring up SMS screen. From there you can tap camera icon to view or take photos.

Also allows you to send an email. Or send a text. Share contact > Email. Could also delete another person's contacts.

Anyone find anything else?

confirmed working for me, iPhone 4 - 4.1

JD914 said:

Another issue that needs to be addressed by Apple

http://www.youtube.com/watch?v=hq8Dok2Th2s

Click to expand...

Yeah, 'cuz when someone absconds with your iphone, they go through that silly process they never heard of and call everyone you know

Nope...

Doesn't do it on my iPhone 4 runnint iOS 4.1...

tryed it 20 X and no luck, running iphone 4 jb 4.1

any one also not being able to do it?

Just to add to this if you have Multifl0w installed you can then access any open apps using the double tap or activator expression you have chosen to enable it.

Works like a charm on 4.1. You can't access any other application, as the home button does nothing, no multitasking, no nothing.

But..... You can make calls with no problems, search/edit a users address book and if you are hooked up to an exchange server, search the GAL on the exchange server.

If a user has an email address associated with them you can press "share contact" and then you have full access to the email client of the user. Email whoever you want, it'll work.

I can see this getting fixed very quickly, What good is enforcing a lock on a phone via exchange if it can be bypassed so easily?
Although of course, this all requires a person to have physical access to your phone.

Can anyone confirm that this still works on the latest 4.2 beta? I would assume so for the time being at least.

iPhone Button Sequence- Bypass Security Lock

Wired just posted a nice way to break into people's iPhones.

http://www.wired.com/threatlevel/20...+wired/index+(Wired:+Index+3+(Top+Stories+2))

You can read the article if you're interested in the "hack", but suffice it to say you may want to watch your iPhone a bit more closely until this is patched.

Tried it with mine- was able to access the Phone app to make non-emergency calls as well as full access to the Address Book (including Edit ability). Nice.

scaredpoet said:

Using a security flaw to get around a security flaw? Ironic, much?

Click to expand...

Apple refuses to fix the PDF exploit in the pre-4.0 firmwares, which means they are basically requiring you to use the jailbreak+patch method on any older iPhone or iPod touch.

It's not like they care.

Already fixed in 4.2. Close the thread.

pipasforjaz said:

tryed it 20 X and no luck, running iphone 4 jb 4.1

any one also not being able to do it?

Click to expand...

Also not able here. My iphone is a iphone 4 32 gb running ios 4.1, Jailbroken with Limera1n final.

My iphone has been produced between sept 25-30 and came with ios 4.1 installed.

As soon as i hit the call button, it writes on the top: emergency calls only.

There is no delay..... no red bar thing then the message, only the message instantly appearing.


________
HERBAL VAPORIZERS

I cant seem to get out of the phone app tho.

Actually just text someone and then you can get to the home screen

''A very similar security flaw discovered on the iPhone in 2008 allowed people to easily bypass the lock screen to access mail, contacts and bookmarks. Apple later acknowledged the bug and issued a software update patching the issue.''

Read More http://www.wired.com/threatlevel/20...Wired:+Index+3+(Top+Stories+2))#ixzz13QdVZhB1


How much time after ( in 2008) they released a new patch ? I hope they will release 4.2 final faster because of that !!!!!!!!!!
________
MOTOR NORTH AMERICA

goobot said:

I cant seem to get out of the phone app tho.

Click to expand...

make a call to 611 or someone once it connects hang up then it will go back to lockscreen

this bug works. I can only stay in phone and cant do anything else but voice control. multitasking doesnt work.

Same here on my 3GS. I think this could be a somewhat possible good feature (like if you lost an iPhone).

Maybe when Apple has us setup our iPhones, we can enter a few "emergency" numbers to contact the original owner. So whenever someone finds it, they can click "dial #1" and then it will call the number. Of course, the number will be hidden to the end user (who finds the phone) and it can just display "Call owner number 1" or something like that.

Crazy that this is happening all over again.

If any of you do find another security hole like this, submit it to: product-security@apple.com

You'll get the glory of your own Common Vulnerabilities and Exposures (CVE) ID.

Here's mine from the last time the passcode lock was bypassed:
http://support.apple.com/kb/HT3129

Cool bug. Seems there is a similar one on the latest droids too

http://www.androidcentral.com/droid-2-bug-allows-anyone-make-calls-passcode-screen

Voice Dialing

Scott90 said:

That's what I did. Voice Control has full functionality, so calling people or dialing numbers is also possible.

Click to expand...

To those who say the voice dialing from the home screen is a bug/flaw, you are incorrect. This is by design and can be turned off under the passcode settings.

However, the emergency call issue is definitely a flaw.

iPhone 3G + iOS 4.1 = FAIL

No workie on my iPhone 3G running iOS 4.1.

I'm running 4.2 and it doesn't work for me. It just takes me back to the pass code lock screen.