iPhone Passcode Flaw Already Addressed for Future Firmware Update?

[MacRumors]

Gizmodo publicizes a security flaw that was publicly posted last night to MacRumors' Discussion Forum. The vulnerability allows individuals to easily bypass the built-in passcode protection offered by Apple to lock your iPhone.

The workaround allows unauthorized individuals access to the iPhone's Safari, Contacts list, SMS, Maps, and Mail.

MacRumors has been told that this security flaw was already reported to Apple earlier this month and has been acknowledged as an issue. A fix will presumably be included in a future firmware update.

Update: A simple fix is available in the meanwhile. Users should set their "Home Button" double-click preference to "Home" or "iPod" rather than the default "iPhone Favorites".

Article Link

[thecartoonguy]

Let's hope sooner than later

[Mindflux]

Originally Posted by thecartoonguy

Let's hope sooner than later

Why? For all those 'h4x0rs' you let use your phone?

[arian19]

who hacked my iphone?

[mogzieee]

Sounds like someone at Apple reads Mac Rumors Discussions and Gizmodo...

[Mykbibby]

Not a big deal in my eyes... If some hacker gets your phone, believe me, a passcode isn't stopping them.

[Beric]

Originally Posted by mogzieee

Sounds like someone at Apple reads Mac Rumors Discussions...

I believe a ton of Apple employees do. We get heard, believe it or not. That's why Arn gets all of the CAD letters on removing leaked photos.

[twoodcc]

well i'm glad to see that Apple is already working on this. hopefully they'll fix it soon

[Masquerade]

OMG and these guys are working in server-OSses :X

[dvkid]

Huge iPhone Security Flaw Puts All Private Information at Risk

Really? Because I don't have a pass-code on my iPhone at the moment. Just don't let random folks use your phone?

Gotta love the AOL bloggers and their TimeWarner craziness.

[Niiro13]

Originally Posted by mogzieee

Sounds like someone at Apple reads Mac Rumors Discussions and Gizmodo...

Originally Posted by Beric

I believe a ton of Apple employees do. We get heard, believe it or not. That's why Arn gets all of the CAD letters on removing leaked photos.

Yup...they're just not allowed to post, right? I thought I read that somewhere on this forum.


Anyway, if this passcode was already being addressed, wouldn't it have come out? Is it not a simple override of the double tapping of the home button when on the passcode screen?

[aardwolf]

I don't even lock my phone... And if I did, I've read that setting your double-click home action to actually go to the home page will prevent this exploit from working.

[Clayne]

Originally Posted by Niiro13

Yup...they're just not allowed to post, right?

Probably. I bet they're reading this right now, laughing.

And I bet they get a lot of laughs watching us try and guess what's coming out, including all the bizarre things we think of.

[gcmexico]

I just tried it...yep security flaw...thanks macrumors

[m4c1nt05h]

"iPhone users who want to guard against this flaw have a really simple solution - in (Settings) General access the Home Button Settings, and switch double-clicking from 'Phone Favorites' (default) to iPod. " - taken from 9to5mac.com

why didn't macrumors post this?

[pavvento]

Originally Posted by dvkid

Huge iPhone Security Flaw Puts All Private Information at Risk

Really? Because I don't have a pass-code on my iPhone at the moment. Just don't let random folks use your phone?

Gotta love the AOL bloggers and their TimeWarner craziness.

I don't think the security concern is having random people use your phone. I think its for the very realistic scenario where your phone might be lost or stolen. Your company (for people on exchange) would most probably want to do a remote wipe immediately, but if someone has the phone and open access they can get to your information before it's cleared out.

For a company hoping to get its phone into the corporate world this is a HUGE oversight.

[thejadedmonkey]

Originally Posted by MacRumors

MacRumors has been told that this security flaw was already reported to Apple earlier this month and has been acknowledged as an issue. A fix will presumably be included in a future firmware update.

Doesn't mean anything. I've submitted bugs to Apple before, and they've been acknowledged, but then thrown out as "intended behavior". I would assume they'd fix it, but still.... don't count your chickens before they hatch!

[Snowcat001]

Originally Posted by Beric

I believe a ton of Apple employees do. We get heard, believe it or not. That's why Arn gets all of the CAD letters on removing leaked photos.

The real question is... who on MacRumors is an Apple employe???
We should have a poll about this
: Who do you think, on this forum, is an apple employe?

[mBox]

Originally Posted by m4c1nt05h

"iPhone users who want to guard against this flaw have a really simple solution - in (Settings) General access the Home Button Settings, and switch double-clicking from 'Phone Favorites' (default) to iPod. " - taken from 9to5mac.com

why didn't macrumors post this?

Funny thing is I did this weeks ago not knowing about the flaw

[AnthonyKinyon]

Does this affect iPod Touch at all? I wouldn't think so given that it's not a phone.

[towlieban]

I've got news for you guys. Last week, I set a passcode and forgot it. Since my phone is jailbroken (I'm on 2.0.1) and has ssh installed, I did some research and found 2 things that need to be changed to completely disable the passcode and it's surprisingly easy. If anyone wants these instructions then let me know

[jtshaw]

Originally Posted by pavvento

I don't think the security concern is having random people use your phone. I think its for the very realistic scenario where your phone might be lost or stolen. Your company (for people on exchange) would most probably want to do a remote wipe immediately, but if someone has the phone and open access they can get to your information before it's cleared out.

For a company hoping to get its phone into the corporate world this is a HUGE oversight.

For what its worth... if you connect to exchange with your iPhone and you lose it you should probably go ahead and change your exchange password asap...

Of course, then you might have to deal with the annoyance of some guy locking your corp. account because he keeps trying to mess with your work e-mail but fails password auth, but it is better then having sensitive data leaked.

[Matthew Yohe]

Originally Posted by towlieban

I've got news for you guys. Last week, I set a passcode and forgot it. Since my phone is jailbroken (I'm on 2.0.1) and has ssh installed, I did some research and found 2 things that need to be changed to completely disable the passcode and it's surprisingly easy. If anyone wants these instructions then let me know

product-security@apple.com

[dagamer34]

It's not a security flaw if it depends on a user's stupidity, FYI

[Sijmen]

Originally Posted by dagamer34

It's not a security flaw if it depends on a user's stupidity, FYI

Uh, what? What's so stupid about setting a passcode and leaving the other settings at their defaults?