Big Security Vulnerability in 3.0!

[heron88]

I dont know if this has been posted yet, I did a search and didnt see anything.

Yesterday I was on my ipod touch enjoying the new push services with TextFree. Like we all know the ipod doesnt go to sleep when you're listening to music or if its plugged in. In my case I was listening to music. So every time a text would come in the ipod would wake from being on hold, and show me my text. Where the security flaw is is that when I click "view" on the push notification to reply to the text it takes me straight into my ipod without prompting me for my passcode. This means anyone can have unrestricted access to my ipod. I assume this would be the same on an iphone too.

This kind of reminds me of the double-click home button issue on the iphone a while ago. Can anyone confirm this happens for you too?

 

[jav6454]

I dont know if this has been posted yet, I did a search and didnt see anything.

Yesterday I was on my ipod touch enjoying the new push services with TextFree. Like we all know the ipod doesnt go to sleep when you're listening to music or if its plugged in. In my case I was listening to music. So every time a text would come in the ipod would wake from being on hold, and show me my text. Where the security flaw is is that when I click "view" on the push notification to reply to the text it takes me straight into my ipod without prompting me for my passcode. This means anyone can have unrestricted access to my ipod. I assume this would be the same on an iphone too.

This kind of reminds me of the double-click home button issue on the iphone a while ago. Can anyone confirm this happens for you too?

Now this something worth talking about. Like OP this glitch, if this is one, leaves the door open for anyne to pry in. I hope they fix it in 3.0.1

 

[heron88]

Yeah I really cant see how they missed this one

 

[doubleatheman]

Yep I love how pointless my passcode is now...

Also with voice control anyone can pick up my phone and say call 555-1234, with no restrictions at all. I passcode sometimes to prevent others from making calls on my phone. So much for that.

 

[jav6454]

Well with 3.0 deadline I can see them forgeting or overlooking pascode permits.

Hopefully they will fix this

 

[johny5]

Surely if you are listening to music then your phone isn't in fact locked down anyway?
I know if I were listening to music and a txt came through then I would like to just click the view button to view the text as oppose to unlocking the phone?
Was this different in the previous firmware? I didn't really notice?

 

[Applejuiced]

I agree.
Obviously if the phone is in use listening to music and the screen not locked I wouldnt want to keep punching in my pin on every single text that comes thru.
Wow, majob security hole

Surely if you are listening to music then your phone isn't in fact locked down anyway?
I know if I were listening to music and a txt came through then I would like to just click the view button to view the text as oppose to unlocking the phone?

 

[heron88]

Same thing happens when its plugged into your computer... Whats the point of a passcode lock if anyone can just plug your ipod/phone in and get unrestricted access?

 

[johny5]

Try locking your phone and then plugging it in to another computer that you havent synced it to.
It will not let you have access and will tell you that you need to unlock your phone first.

 

[Phil A.]

Wirelessly posted (iPod touch 32GB: Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16)

Yep I love how pointless my passcode is now...



Also with voice control anyone can pick up my phone and say call 555-1234, with no restrictions at all. I passcode sometimes to prevent others from making calls on my phone. So much for that.

You can disable voice dialling when the phone is locked.

 

[The General]

Lock it. Problem solved.