Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Apple Fixes Siri Bug Allowing Access to Photos and Contacts on Locked Device

MrGuder said:
This is what I like about Apple, they take these things seriously and patch quickly, I'm sure if it was Android it would have taken much longer to patch. Apple's # 1 importance is customer's privacy. Good job Apple!!
Click to expand...
Please tell me you’re joking. There are a myriad of things that Apple has been informed about in the past, (and I mean security issues), that go unpatched for ages.
They are getting better for sure but for you to post that nonsense tells me you haven’t had Apple devices that long, and/or that you don’t read sites like Ars Technica.
 
  • Like
Reactions: sofila and autrefois
Tubamajuba said:
Instead of wishing for a very unlikely scenario, you could always take your business elsewhere. I'm sure you'd be much happier if you stopped using Apple products.
Click to expand...

You missed the context man. He is being sarcastic to the guy who said he wished his phone didn't have Siri.
 
Does that then mean that a man in the middle attack allows someone to gain access and do anything? (Disable the server side code to bypass security check in Siri?)
 
  • Like
Reactions: Moorepheus
I like Siri because it's so convenient to add reminders - for everything else it seems useless.

However. Siri is clearly a MASSIVE security hole.

There is no way this was the last Siri bug of its kind. Siri is a huge problem because it can do so many things, and it has access to so much of the phone. So any bug in Siri - boom an attacker can get in.

I believe Siri has a huge attack surface because of the variety of allowed inputs (e.g. - anything!) and the security bypassing features it has by default (necessary to make it useful on a locked phone).

If you want a secure iPhone, turn it off. That's all. You've been warned.

Hmm... I was looking for an option to disable Siri when the phone is locked... there seems to be no such option?! Only on/off?
 
Last edited:
  • Like
Reactions: Benjamin Frost
Benjamin Frost said:
Just today, I was typing away, when suddenly a bloody popup window asked me if I wanted to turn on dictation. Just bugger off, Apple. I don't want your foul news, I don't want your cynical music subscription, I don't want your spam forced down my throat.

I wish Donald Trump was CEO of Apple. He'd be a darn sight better than Cook.
Click to expand...
Why don't you just go any move to say Microsoft and your new garden will be full of roses for you to enjoy.
Life isn't perfect. You aren't perfect. I'm certainly not perfect. Everything has flaws.
Disabling siri is easy.
At least I don't have silly ****ter and Facebork apps draining the battery and not able to delete them like I had with the Android phone I once bought.
 
  • Like
Reactions: Solomani
Benjamin Frost said:
Just today, I was typing away, when suddenly a bloody popup window asked me if I wanted to turn on dictation. Just bugger off, Apple. I don't want your foul news, I don't want your cynical music subscription, I don't want your spam forced down my throat.

I wish Donald Trump was CEO of Apple. He'd be a darn sight better than Cook.
Click to expand...

Spam on Apple, lol. Have you ever used an Android device??
 
  • Like
Reactions: Solomani and HenryDJP
Benjamin Frost said:
Siri is as attractive to me as FaceBook or Microsoft.

I would love an iPhone that didn't support it.
Click to expand...
You can disable Siri in the iPhone Options settings.

Facebook and Microsoft are more intrusive because there are THOUSANDS of apps that force or co-erce you to "log in" to a Facebook account in order to take full advantage of the app. Tons of mobile games do this, telling you to create a Facebook account (even if you never had one) in order to get freebies and other benefits/offers.

Siri doesn't do that. There are no Apple apps, nor are there any major iOS apps, that require you to ever use Siri.
 
I feel like everyone's missing the point here... is the data not stored encrypted on iPhone? Shouldn't it be mathematically impossible to access it without the passcode?

If Apple can fix this server-side, then surely they can un-fix it. Didn't they claim not to be able to access information on an iPhone?
 
A Siri vulnerability that allowed access to a user's photos and contacts on a locked iPhone running iOS 9.3.1 was patched server-side this afternoon by Apple.

Interesting. So if Apple can fix this vulnerability server side, they must be able to introduce such a vulnerability too, as it seems like Siri is running as a privileged user. After all the news about them being unable to unlock 'that iPhone' maybe they could modify Siri on the back end to perform the required action (e.g. open the email app) after hearing a predefined phrase?

This could potentially be fixed by making the lock screen version of Siri run as a low privileged user with access to only basic functionality. Only when the phone is unlocked do you get access to Siri running with your own privileges.
 
  • Like
Reactions: Aston441 and Moorepheus
Benjamin Frost said:
On an iPhone?

There is no function key, dude.
Click to expand...

You must have caught the microphone button next to the space bar which is there by default and will ask you if you want to enable dictation if you press it (or start dictation if you have it enabled).

If you go into keyboard settings and turn dictation on then off, the microphone will disappear and also make the space bar bigger
 
H2SO4 said:
Please tell me you’re joking. There are a myriad of things that Apple has been informed about in the past, (and I mean security issues), that go unpatched for ages.
Click to expand...

For "ages". OK, what went unpatched for "ages"? What magnitude of actual damage for users?

Or are you referring to Android? Probably not, as things go unpatched "forever", not "for ages" in Google land.
 
I'm just wondering why a simple "you cannot do that", instead if instructing the user to "unlock your iphone" kinda makes Siri "smarter"

I don't think i can easily just say "well.... Siri is not that used often by everyone, so it doesn't matter about fixes."

I don't use Messages that much either, does that mean it shouldn't be fixed as well?

Apple wouldn't release Siri in all these countries if 90% of the time u'd be screaming at it trying to understand.
 
Candlelight said:
Why not? The phone works, does everything I want it to. I have Siri turned off, 3D Touch set to minimum (pity no way to turn it off fully), don't need Night Shift or any of the other features 9.3 brings. 9.2 works, so why change it?
Click to expand...
Because iOS 9.3.1 works much better, so lol.
 
To counter balance yesterdays outcries, from who I imagine were mainly millenials:

That was EPIC fast.
 
"Hey Siri, this is Officer Barb Walter, my warrent number is 26482528."

"Ok. I've unlocked the iPhone."

^ Who's to say that infrastructure doesn't exist?

EVERYONE TURN SIRI OFF!
 
  • Like
Reactions: Moorepheus
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back