New iPhone Passcode Security Flaw Discovered in iOS 6.1.3

MacRumors · Mar 20, 2013, 02:18 PM

Following yesterday's release of iOS 6.1.3, which fixed two bugs allowing the iPhone's passcode lock to be bypassed, another passcode security flaw has been discovered.

The vulnerability, which only affects the iPhone 4, involves the Voice Dial command, as demonstrated in the video below from YouTube user videosdebarraquito.

iPhoneinCanada tested the method in the video using an iPhone 4 running iOS 6.1.3 and found that the security flaw does indeed exist, giving a potential intruder access to both contacts and photos.

Like the previous passcode vulnerability, the current hack involves a complicated set of steps that includes initiating Voice Dial command and quickly ejecting the phone's SIM card.

When the SIM card is removed, the phone opens the recent call log, which gives access to the contact list. In the contact list, adding a photo also gives access to all of the pictures on the device.

The previous passcode vulnerability was discovered in mid-February, and it took Apple more than a month to push a fix. An update for the current bypass could follow a similar timeline, but the vulnerability can be fixed by disabling Voice Dial from the Passcode Lock menu.

At this time, the vulnerability has only been shown to work with the iPhone 4. We were unable to reproduce the results with an iPhone 5 with Siri disabled, though the bug may potentially affect the pre-Siri iPhone 3GS as well.

Update 1:07 PM: iPhoneBlog.de reports that it has reproduced the issue on an iPhone 5 with Siri disabled, although we have still been unable to do so.

Article Link: New iPhone Passcode Security Flaw Discovered in iOS 6.1.3

ZacNicholson · Mar 20, 2013, 02:18 PM

wow that was fast

iGuardian · Mar 20, 2013, 02:22 PM

This is ridiculous. I understand that this is insecure but who the hell comes up with such an elaborate way to access just your phone and photos? Your phone's still safe from the average Joe.

EmbraceTheOne · Mar 20, 2013, 02:22 PM

I don't see the big deal in this...

Radio · Mar 20, 2013, 02:22 PM

Meh who cares

MattMJB0188 · Mar 20, 2013, 02:25 PM

Does anyone even use the iPhone 4 anymore?

troop231 · Mar 20, 2013, 02:25 PM

Wow, who figures this stuff out?

What's next? Stand on your head, rub your stomach while ejecting the SIM 3 times with 1.5 second pauses in between each one.

anberlinairlift · Mar 20, 2013, 02:27 PM

I'm just glad that Macrumors posted this. Complicated as it is, we want to make sure that criminals everywhere with stolen iPhone 4's will have no trouble accessing them.

/sarcasm

lunaoso · Mar 20, 2013, 02:27 PM

Quote:

Originally Posted by MattMJB0188

Does anyone even use the iPhone 4 anymore?

It's crazy but people still even buy them. And then they complain that it's too slow.

roxxette · Mar 20, 2013, 02:27 PM

Quote:

Originally Posted by troop231

Wow, who figures this stuff out?

What's next? Stand on your head, rub your stomach while ejecting the SIM 3 times with 1.5 second pauses in between each one.

Hahaha was thinking the same thing, dont kmow how they figure this stuff out !

WatchTheThrone · Mar 20, 2013, 02:27 PM

So expect 6.1.4 next week lol and 6.1.5 the week after that and so on and so forth....

jmcrutch · Mar 20, 2013, 02:27 PM

Are they using code to figure these out or is someone that bored that they'll employ the trial and error method? There must be a million different possible combinations of things you can try together, literally, in order to discover such a vulnerability.

M-O · Mar 20, 2013, 02:28 PM

perhaps they can fix this security hole by replacing the voice control feature on iPhone 4 with Siri.

...just a thought.

Idgit · Mar 20, 2013, 02:29 PM

Not sure if you're joking or not. In Canada, we have 3-year contracts so many of us are still using the iPhone 4. My contract doesn't expire until this August.

Quote:

Originally Posted by MattMJB0188

Does anyone even use the iPhone 4 anymore?

jmcrutch · Mar 20, 2013, 02:29 PM

Up down up down left right left right B A start ...

joelvega125 · Mar 20, 2013, 02:30 PM

the people who figure out this crap are idiots. If I lose my phone I'm effed anyway. The old "voice dial paperclip sim tray pop out" trick will be the least of my worries.

RenoG · Mar 20, 2013, 02:30 PM

Yeah and thank you for putting the wonderful new quick and easy how-to out for all to see on bypassing the passcode. Now every savy iphone thief and hacker can go back to business as usual.

goobot · Mar 20, 2013, 02:31 PM

Wouldn't this effect the 3GS as well considering it has the same type voice control?

M-O · Mar 20, 2013, 02:31 PM

Quote:

Originally Posted by lunaoso

It's crazy but people still even buy them. And then they complain that it's too slow.

I just got one a few months ago (second hand). I don't feel it's too slow. Sure, it's slower than iPhone 5, but it's plenty fast for me.

still, if i were going to buy one on contract i'd definitely go with the 5.

troop231 · Mar 20, 2013, 02:32 PM

Quote:

Originally Posted by jmcrutch

Up down up down left right left right B A start ...

http://www.youtube.com/watch?feature...7n2AJj4#t=400s

tevion5 · Mar 20, 2013, 02:33 PM

Quote:

Originally Posted by MattMJB0188

Does anyone even use the iPhone 4 anymore?

Millions

PinoyAko · Mar 20, 2013, 02:34 PM

iPhone 4 has a Siri?

RenoG · Mar 20, 2013, 02:35 PM

Quote:

Originally Posted by MattMJB0188

Does anyone even use the iPhone 4 anymore?

Iphones don't suddenly expire when a new comes out you know...My wife has a 4 and it works perfectly, she has absolutely no desire or need whatsoever to upgrade..for what!

PinoyAko · Mar 20, 2013, 02:35 PM

Quote:

Originally Posted by troop231

Wow, who figures this stuff out?

What's next? Stand on your head, rub your stomach while ejecting the SIM 3 times with 1.5 second pauses in between each one.

Excuse me, 2.3 seconds not 1.5 seconds.

iMikeT · Mar 20, 2013, 02:36 PM

Who used Voice Command before Siri?

Mar 20, 2013, 02:18 PM	#1
MacRumors macrumors bot Join Date: Apr 2001	New iPhone Passcode Security Flaw Discovered in iOS 6.1.3 Following yesterday's release of iOS 6.1.3, which fixed two bugs allowing the iPhone's passcode lock to be bypassed, another passcode security flaw has been discovered. The vulnerability, which only affects the iPhone 4, involves the Voice Dial command, as demonstrated in the video below from YouTube user videosdebarraquito. iPhoneinCanada tested the method in the video using an iPhone 4 running iOS 6.1.3 and found that the security flaw does indeed exist, giving a potential intruder access to both contacts and photos. Like the previous passcode vulnerability, the current hack involves a complicated set of steps that includes initiating Voice Dial command and quickly ejecting the phone's SIM card. When the SIM card is removed, the phone opens the recent call log, which gives access to the contact list. In the contact list, adding a photo also gives access to all of the pictures on the device. The previous passcode vulnerability was discovered in mid-February, and it took Apple more than a month to push a fix. An update for the current bypass could follow a similar timeline, but the vulnerability can be fixed by disabling Voice Dial from the Passcode Lock menu. At this time, the vulnerability has only been shown to work with the iPhone 4. We were unable to reproduce the results with an iPhone 5 with Siri disabled, though the bug may potentially affect the pre-Siri iPhone 3GS as well. Update 1:07 PM: iPhoneBlog.de reports that it has reproduced the issue on an iPhone 5 with Siri disabled, although we have still been unable to do so. Article Link: New iPhone Passcode Security Flaw Discovered in iOS 6.1.3
	0

Mar 20, 2013, 02:18 PM	#2
ZacNicholson macrumors 6502 Join Date: Jun 2011 Location: Indiana	wow that was fast __________________ follow me on twitter @zac_nicholson watch my youtube www.youtube.com/mrzacnicholson 2011 13" MBP, iPhone 4 (jailbroken), iPad 3 32 GB Verizon(jailbroken), Apple tv 2(jailbroken)
	4

Mar 20, 2013, 02:22 PM	#4
EmbraceTheOne macrumors 6502a Join Date: Aug 2011	I don't see the big deal in this... __________________ 13" Aluminum Macbook Pro. 2.7ghz 8GB Ram. iPhone 4S Black 16GB
	1

Mar 20, 2013, 02:25 PM	#7
troop231 macrumors 601 Join Date: Jan 2010 Location: At the gym	Wow, who figures this stuff out? What's next? Stand on your head, rub your stomach while ejecting the SIM 3 times with 1.5 second pauses in between each one. __________________ My iOS apps: MyTradeshow , Outdoor Rules & Regulations iPhone 5 MBP 15" 2.3 i7 HR-AG
	28

Mar 20, 2013, 02:27 PM	#8
anberlinairlift macrumors member Join Date: Nov 2010 Location: Charlotte Hall, MD	I'm just glad that Macrumors posted this. Complicated as it is, we want to make sure that criminals everywhere with stolen iPhone 4's will have no trouble accessing them. /sarcasm __________________  15" MacBook Pro (2.53 GHz, Mid 2009)  32GB iPhone 4  Think Different.
	8

Mar 20, 2013, 02:22 PM	#3
iGuardian macrumors 6502 Join Date: Aug 2008 Location: Vancouver, BC	This is ridiculous. I understand that this is insecure but who the hell comes up with such an elaborate way to access just your phone and photos? Your phone's still safe from the average Joe.
	8

Mar 20, 2013, 02:22 PM	#5
Radio macrumors 65816 Join Date: Mar 2012 Location: Central California	Meh who cares
	1

Mar 20, 2013, 02:25 PM	#6
MattMJB0188 macrumors 6502a Join Date: Dec 2009 Location: Indiana	Does anyone even use the iPhone 4 anymore?
	3

Mar 20, 2013, 02:27 PM	#11
WatchTheThrone macrumors regular Join Date: Aug 2011	So expect 6.1.4 next week lol and 6.1.5 the week after that and so on and so forth....
	0

Mar 20, 2013, 02:27 PM	#12
jmcrutch macrumors regular Join Date: Jul 2010	Are they using code to figure these out or is someone that bored that they'll employ the trial and error method? There must be a million different possible combinations of things you can try together, literally, in order to discover such a vulnerability.
	3

Mar 20, 2013, 02:28 PM	#13
M-O macrumors 6502 Join Date: Mar 2011	perhaps they can fix this security hole by replacing the voice control feature on iPhone 4 with Siri. ...just a thought.
	3

Mar 20, 2013, 02:29 PM	#15
jmcrutch macrumors regular Join Date: Jul 2010	Up down up down left right left right B A start ...
	12

Mar 20, 2013, 02:30 PM	#16
joelvega125 macrumors member Join Date: Jun 2010	the people who figure out this crap are idiots. If I lose my phone I'm effed anyway. The old "voice dial paperclip sim tray pop out" trick will be the least of my worries.
	0

Mar 20, 2013, 02:30 PM	#17
RenoG macrumors 6502a Join Date: Oct 2010	Yeah and thank you for putting the wonderful new quick and easy how-to out for all to see on bypassing the passcode. Now every savy iphone thief and hacker can go back to business as usual.
	2

Mar 20, 2013, 02:31 PM	#18
goobot macrumors 68040 Join Date: Jun 2009 Location: long island NY	Wouldn't this effect the 3GS as well considering it has the same type voice control?
	2

Mar 20, 2013, 02:34 PM	#22
PinoyAko macrumors 6502 Join Date: Nov 2012	iPhone 4 has a Siri?
	0

Mar 20, 2013, 02:36 PM	#25
iMikeT macrumors 68010 Join Date: Jul 2006 Location: California	Who used Voice Command before Siri?
	0

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode