I have just discovered a major security flaw in iOS 6.1

[Newjackboy]

Originally Posted by robbyg

Find my iPhone is really a mess. It needs these two fixes.

2) It should have worked with the phones serial number or CID so that once you register it the phone remains trackable by you and only you, unless you decide to login into Apple and release the number when your selling or giving away the phone.

If those two things where done it would not matter what the thief did because sooner or later he will have a Sim in the phone or wifi connected and Pow you know exactly where he is and if you can't get your phone back because he's in Nigeria, etc. You will still be able to remotely wipe his phone every week or so just to piss him off.

THIS! This is smartest idea I've ever read on macrumors. C'mon apple, do it!

[Mlrollin91]

Originally Posted by dictoresno

LTE is based on GSM technology, which requires network authentication using a SIM. so they have integrated its need into the iphone 5. without it, it will render even the CDMA side useless.

Thanks for the information. Didn't have a clue.

[throAU]

Originally Posted by S1RiOS

Thanks friends, the flaw is also present in iOS 6.0.1 and 6.0.2 I have 10B5126b 6.1 but I'm not developer, I do not know how to inform to Apple, I hope Apple is reading this and contact me.

Have you tried actually emailing them, or initiating any form of contact at all (support case, etc?)


Failing that report it to CERT who will then probably contact apple and publish a security advisory if they can replicate the issue.

[Baggio]

Originally Posted by robbyg

Find my iPhone is really a mess. It needs these two fixes.

1) It should have been integrated into the ios like the weather app or any of the others, that way it could not be removed and it should have no Off mode, that should be something that can only be done on the net when you log into the account.

2) It should have worked with the phones serial number or CID so that once you register it the phone remains trackable by you and only you, unless you decide to login into Apple and release the number when your selling or giving away the phone.

If those two things where done it would not matter what the thief did because sooner or later he will have a Sim in the phone or wifi connected and Pow you know exactly where he is and if you can't get your phone back because he's in Nigeria, etc. You will still be able to remotely wipe his phone every week or so just to piss him off.

What if location services are turned off?

[S1RiOS]

Originally Posted by C DM

Is it really a (security) flaw or perhaps just some possibly misunderstood yet valid usecase?

Especially when it comes to "simple and easy to pull off trick[s]", far too many times people have mentioned security flaws and it simply turned out to be nothing more than a misunderstanding or a particular phone/app configuration of some sort, and certainly not a flaw, let alone a (major) security one.

Not so, friend. My iPhone is clean, recently updated to version 6.1 beta 4, and I've tried the trick in a 4S and iPhone 5 with the same result. If anyone in the JB world can take advantage ... I do not know.
Maybe Apple's enemies are interested it to be released, but I am an iPhone lover and I'll contact Apple soon for fix it.

----------

Originally Posted by Starrbuck

If he's got 6.1, isn't that a beta, and that would mean he's a developer, right? I would think Apple makes it clear how they report bugs.

I am not a developer, anyone can update to 6.1 beta version, there are many tutorials.

[MultiMediaWill]

Originally Posted by S1RiOS

Not so, friend. My iPhone is clean, recently updated to version 6.1 beta 4, and I've tried the trick in a 4S and iPhone 5 with the same result. If anyone in the JB world can take advantage ... I do not know.
Maybe Apple's enemies are interested it to be released, but I am an iPhone lover and I'll contact Apple soon for fix it.

----------



I am not a developer, anyone can update to 6.1 beta version, there are many tutorials.

Just tell us how to do it.

[Myiphone7]

Originally Posted by S1RiOS

This simple and easy to pull off trick allows for an attacker to bypass an iPhone's pass code and obtain full access (see and edit) to contacts list, list of recent calls, favorite contacts, and even make a call to any phone number on the hacked device and erase the log.
Should I shut up? or should I publish the trick for the iPhone users are prevented?

Guys this guy is brand new on here.

[Ste Nova]

Originally Posted by robbyg

Find my iPhone is really a mess. It needs these two fixes.

1) It should have been integrated into the ios like the weather app or any of the others, that way it could not be removed and it should have no Off mode, that should be something that can only be done on the net when you log into the account.

2) It should have worked with the phones serial number or CID so that once you register it the phone remains trackable by you and only you, unless you decide to login into Apple and release the number when your selling or giving away the phone.

If those two things where done it would not matter what the thief did because sooner or later he will have a Sim in the phone or wifi connected and Pow you know exactly where he is and if you can't get your phone back because he's in Nigeria, etc. You will still be able to remotely wipe his phone every week or so just to piss him off.

all of that... but i also want to be able to switch on the camera and the mic so i can see what the phone can see

[r2shyyou]

Originally Posted by Myiphone7

Guys this guy is brand new on here.

Guy, what's your point?

[LaunchpadBS]

Originally Posted by S1RiOS

Thanks friends, the flaw is also present in iOS 6.0.1 and 6.0.2 I have 10B5126b 6.1 but I'm not developer, I do not know how to inform to Apple, I hope Apple is reading this and contact me.

And if you're not a dev how'd you come to have iOS 6? There are very clear T&C's for all dev's regarding unauthorized device usage.

Anyway I'm a dev and can report the issue via the portal, can you PM it to me?

[Smartass]

find my iphone is totally useless if somebody steals your phone. The only way you can then track the phone is by its IMEI code via network operator... so yes, apple should make this thing a little more usefull. Unless they like that peoples iphone's get stolen so they have to buy a new one

[okwhatev]

Originally Posted by Smartass

find my iphone is totally useless if somebody steals your phone. The only way you can then track the phone is by its IMEI code via network operator... so yes, apple should make this thing a little more usefull. Unless they like that peoples iphone's get stolen so they have to buy a new one

This is one of, if not THE BEST, reasons to jailbreak currently. Cydia apps like "IGotYa" prevent the iPhone from being powered off on the lock screen. So if you set your iphone to automatically lock every minute, there will be no way for the thief to turn off the phone. While it's true that ejecting the SIM card will indeed make an iphone impossible to track, most thiefs don't know this much less have a paper clip available the moment they're stealing your phone. This gives you a huge head start in tracking the device before they can hook it to a computer to wipe it.

Recently I was robbed by two teenagers who placed a semi-automatic gun to my face near Sony Pictures studios in the early evening. Right by a police station, no less. The douchbags who made off with my phone weren't able to turn it off, obviously freaked out about it, and threw it into the side of a freeway overpass. I tracked it with Find My iPhone, called the police who were searching that area for evidence, sent a lost beep sound to it, and it was recovered. There would've been no possible way to have done that if the phone was able to have been turned off the moment it was stolen. I would've been out $700.

Apple should definitely add a 'prevent OFF' when the iPhone is in the lock screen option. Until then, I'm buying theft insurance with my next iPhone. It's not worth getting killed over.

[Ste Nova]

Originally Posted by okwhatev

Apple should definitely add a 'prevent OFF' when the iPhone is in the lock screen option. Until then, I'm buying theft insurance with my next iPhone. It's not worth getting killed over.

have you invested in a gun?

[throAU]

Originally Posted by Myiphone7

Guys this guy is brand new on here.

Means nothing.

You are not your post count.


I mean i signed up in Feb 2012, but I've been a mac user 5 years and in the PC industry (unix guy) for 18....

[MonkeySee....]

I can't believe people are replying to this attention seeking thread?

I can't believe I'm replying?

I can't believe I'm still here typing.

[C DM]

Originally Posted by S1RiOS

Not so, friend. My iPhone is clean, recently updated to version 6.1 beta 4, and I've tried the trick in a 4S and iPhone 5 with the same result. If anyone in the JB world can take advantage ... I do not know.
Maybe Apple's enemies are interested it to be released, but I am an iPhone lover and I'll contact Apple soon for fix it.

----------



I am not a developer, anyone can update to 6.1 beta version, there are many tutorials.

None of that really says much whether or not what you think you have come across is really a flaw, that is actually a security flaw, and a major one at that. Without some more information about it it's really hard to say that it is that or might even be that.

As mentioned, in the past people have also came out to talk about major security flaws only to realize that what they were observing (even trying different phones, etc.) was something that was just configured in a way that they didn't realize, or something along those lines, and far from a major security flaw, or even really a flaw.

[Bahroo]

Report it to Apple

[S1RiOS]

Originally Posted by C DM

None of that really says much whether or not what you think you have come across is really a flaw, that is actually a security flaw, and a major one at that. Without some more information about it it's really hard to say that it is that or might even be that.

As mentioned, in the past people have also came out to talk about major security flaws only to realize that what they were observing (even trying different phones, etc.) was something that was just configured in a way that they didn't realize, or something along those lines, and far from a major security flaw, or even really a flaw.

Ok, I'm going to show through a video by PM, that it is a major security flaw, but I will not explain "how to" do it.
I have already contacted Apple and am waiting for feedback, but, anyway, is also posted in this thread of the existence of the fault, and if Apple wants to fix it, they can simply ask me how it is produced.
Thank you very much to everyone for helping me decide and if the flaw persists, I will surely put it in your knowledge.

[SAD*FACED*CLOWN]

Originally Posted by Mlrollin91

How exactly is that a major security flaw? So they have access to the phone? I think a larger flaw is being able to turn off the phone when locked, therefore Find My iPhone does not work and the potential for it to be restored and never found.

has something changed? when has find my iphone not worked when the phone is off? I've tried find my iPhone with my iPhone turned off and it still worked...

[Mlrollin91]

Originally Posted by SAD*FACED*CLOWN

has something changed? when has find my iphone not worked when the phone is off? I've tried find my iPhone with my iPhone turned off and it still worked...

Its posting the last signal when the device was on. When the device is fully powered off or the battery dies and then moves away from the last known position it will stop updating and not send a "true" signal.

[scaredpoet]

Originally Posted by S1RiOS

Ok, I'm going to show through a video by PM, that it is a major security flaw, but I will not explain "how to" do it.

That's not evidence. If you're not showing how it's done, then whoever looks at that video has no clue what caused whatever it is you claim the iPhone is doing.

[S1RiOS]

Originally Posted by scaredpoet

That's not evidence. If you're not showing how it's done, then whoever looks at that video has no clue what caused whatever it is you claim the iPhone is doing.

I have not yet heard that Apple will do something about it.

What do you think?

[C DM]

So, is the supposed flaw there in the final version of iOS 6.1? What's the latest in relation to this?

[cfs112]

Originally Posted by C DM

So, is the supposed flaw there in the final version of iOS 6.1? What's the latest in relation to this?

exactly, can this flaw be replicated in the new release of 6.1?

[paulbennett95]

I doubt there was a real flaw, probably a kid trying to get attention/troll.

No tangible information was given and he was sketchy about the topic.

I could be wrong though.