Apple Fixes Siri Bug Allowing Access to Photos and Contacts on Locked Device

Discussion in 'MacRumors.com News Discussion' started by MacRumors, Apr 5, 2016.

  1. MacRumors macrumors bot

    MacRumors

    Joined:
    Apr 12, 2001
    #1
    [​IMG]


    A Siri vulnerability that allowed access to a user's photos and contacts on a locked iPhone running iOS 9.3.1 was patched server-side this afternoon by Apple.

    Shared last night by Jose Rodriguez, the vulnerability used Siri's ability to access Twitter to find an email link or phone number, which could be pressed to open up an editable list of contacts even on a device that was locked. Through access to contacts, a user's full photo library was also visible.

    As seen in the video below, the vulnerability relied on asking Siri to perform a Twitter search. If an email address, phone number, or other contact related detail came up, it would give direct access to Photos and Contact data. While the method worked on the iPhone 6s as of this morning, it is now disabled on all devices because it is no longer possible for Siri to conduct a Twitter search on a locked device.


    When using a locked iPhone, asking Siri to "Search Twitter" now results in the personal assistant saying "You'll need to unlock your iPhone first." Without the ability to search Twitter on a locked device, there is no way to get the exploit to work. Apple confirmed the fix in a short statement given to The Washington Post.

    According to 9to5Mac, a second Siri-related bug was also fixed today. Previously it was possible to enable both Night Shift and Low Power Mode by asking Siri to enable Night Shift after Low Power Mode was turned on, but that is no longer possible. Siri now warns that turning on Night Shift requires turning off Low Power Mode.

    In early iOS 9.3 betas, Night Shift did work with Low Power Mode, but in iOS 9.3 beta 4, Apple removed the functionality. Night Shift and Low Power Mode cannot be run simultaneously.

    Article Link: Apple Fixes Siri Bug Allowing Access to Photos and Contacts on Locked Device
     
  2. spherox macrumors member

    Joined:
    Jan 26, 2015
    #2
    Hate Apple or not, but you have to give them props for these security updates. Personally, the fact that I only see this bypass on YouTube a few hours ago and have just seen an article about Apple sending out an update to fix it just amazes me. I remember when I had an LG and I had to beg and pray that I would even get an update, lol.
     
  3. Benjamin Frost Suspended

    Benjamin Frost

    Joined:
    May 9, 2015
    Location:
    London, England
    #3
    Siri is as attractive to me as FaceBook or Microsoft.

    I would love an iPhone that didn't support it.
     
  4. djcerla macrumors 68000

    djcerla

    Joined:
    Apr 23, 2015
    Location:
    Italy
    #4
    Actually it was a server side fix, not a software update.
    --- Post Merged, Apr 5, 2016 ---
    Options>General>Siri>disable

    There you have it.
     
  5. smacrumon, Apr 5, 2016
    Last edited: Apr 5, 2016

    smacrumon macrumors 68030

    smacrumon

    Joined:
    Jan 15, 2016
    #5
    "Hey, Siri. Why doesn't Apple pay at a very minimum 30% tax
    in the country where the actual sale is made?"
    "Let me check on that..."

    "Did you require access to a user's photos and contacts instead?"
     
  6. Norbs12, Apr 5, 2016
    Last edited: Apr 6, 2016

    Norbs12 macrumors 6502

    Norbs12

    Joined:
    Apr 24, 2015
    Location:
    Mountain View, CA
    #6
    If ONLY there was a way to uhh disable it... :rolleyes:
     
  7. elmateo487 macrumors 6502a

    Joined:
    Jun 12, 2008
    #7
    Wow. Just. Wow. The all high and mighty more attractive than Facebook and Microsoft person can't figure out how to turn off siri
     
  8. MrGuder macrumors 68030

    Joined:
    Nov 30, 2012
    #8
    This is what I like about Apple, they take these things seriously and patch quickly, I'm sure if it was Android it would have taken much longer to patch. Apple's # 1 importance is customer's privacy. Good job Apple!!
     
  9. CrystalPepsi macrumors regular

    CrystalPepsi

    Joined:
    Feb 3, 2011
    #9
    Wow. Delete your account.
     
  10. Benjamin Frost Suspended

    Benjamin Frost

    Joined:
    May 9, 2015
    Location:
    London, England
    #10
    Just today, I was typing away, when suddenly a bloody popup window asked me if I wanted to turn on dictation. Just bugger off, Apple. I don't want your foul news, I don't want your cynical music subscription, I don't want your spam forced down my throat.

    I wish Donald Trump was CEO of Apple. He'd be a darn sight better than Cook.
     
  11. cdm283813 macrumors 6502

    Joined:
    Jan 10, 2015
    #11
    That is the one thing I will miss. When you have issues with iPhone or iOS tons of people find out. I still have my 6S but the S7 is my daily driver until the iPhone 7 comes out. Then it's back to Apple. Hard liking 2 mobile operating systems.
     
  12. AppleToTheMax macrumors newbie

    Joined:
    Apr 5, 2016
    #12
    It appears that Apple has also disabled the ability to activate Night Shift through Siri when low power mode is active...
     
  13. Hastings101 macrumors 68020

    Hastings101

    Joined:
    Jun 22, 2010
    Location:
    K
    #13
    Yeah, he could build a wall around Siri and then we'd never have to hear from her again!
     
  14. vertsix macrumors 65816

    vertsix

    Joined:
    Aug 12, 2015
  15. Candlelight macrumors 6502a

    Candlelight

    Joined:
    Oct 12, 2011
    Location:
    New Zealand
    #15
    Staying with 9.2.0 until the day I sell the phone.
     
  16. Keirasplace macrumors 601

    Joined:
    Aug 6, 2014
    Location:
    Montreal
    #16
    That was already the case, at least in the betas of 9.3
     
  17. 952863 Suspended

    Joined:
    Mar 30, 2015
    #17
    Great job Apple. You fixed that pretty damn quick!
     
  18. chrfr macrumors 604

    Joined:
    Jul 11, 2009
    #18
    Wow. This is triggered by pressing the "fn" key twice, quickly. I don't see how it could be considered "spam."
    https://support.apple.com/HT202584
     
  19. Benjamin Frost Suspended

    Benjamin Frost

    Joined:
    May 9, 2015
    Location:
    London, England
    #19
    On an iPhone?

    There is no function key, dude.
     
  20. b0nd18t macrumors 6502

    b0nd18t

    Joined:
    Apr 9, 2012
    #20
    Okay you've baited me... Why?
     
  21. Soccertess macrumors 65816

    Joined:
    Oct 19, 2005
    #21
    GUYS! We are all safe.. It's not like Siri actually understands that many people...

    If it had the capability of google now, then there would be an issue!
     
  22. Candlelight macrumors 6502a

    Candlelight

    Joined:
    Oct 12, 2011
    Location:
    New Zealand
    #22
    Why not? The phone works, does everything I want it to. I have Siri turned off, 3D Touch set to minimum (pity no way to turn it off fully), don't need Night Shift or any of the other features 9.3 brings. 9.2 works, so why change it?
     
  23. djcerla macrumors 68000

    djcerla

    Joined:
    Apr 23, 2015
    Location:
    Italy
    #23
    Security.
    Updates.
     
  24. Tubamajuba macrumors 68020

    Joined:
    Jun 8, 2011
    Location:
    Done with MacRumors, the trolls have won
    #24
    Instead of wishing for a very unlikely scenario, you could always take your business elsewhere. I'm sure you'd be much happier if you stopped using Apple products.
     
  25. Joey2010 macrumors newbie

    Joey2010

    Joined:
    Apr 5, 2016
    #25
    Is it true that due to Team Mobiles poor service; Sprint will purchase Team Mobile for .20 cents on the dollar on 4-6-2016?
     

Share This Page