Complex Passcode Bypass Method Exposes iPhone Contacts and Photos in iOS 12

[MacRumors]

A passcode bypass vulnerability has been discovered in iOS 12 that potentially allows an attacker to access photos and contact details on a locked iPhone.

The rather convoluted bypass method was shared in a video by Jose Rodriguez, who has discovered iOS bugs in the past that Apple has subsequently fixed.

With physical access to the locked device, the attacker first asks Siri to activate VoiceOver, sleeps the device with the Side button, and then calls the iPhone using another device. Once the call screen shows up, the attacker taps the Message button, opts to create a custom message, and then taps the plus (+) icon in the top right.

Next, on the other phone, the attacker sends a text or iMessage to the target iPhone, whose screen is then double-tapped when the message notification appears. This causes an odd behavior in the UI, since it highlights the plus icon underneath.

After a short wait, the screen goes white and the notification disappears, but the VoiceOver's text selection box is apparently still tappable and can now be used to access the Messages interface. Following multiple screen swipes, the VoiceOver is heard to say "Cancel," which reveals the original Messages screen.

Adding a new recipient to the message and selecting a numeral from the virtual keyboard then reveals a list of recently dialed or received phone numbers and contacts. Further, if one of the numbers or contacts includes an info ("i") button, disabling VoiceOver and tapping the button shows the contact's information. Performing a 3D Touch action on the contact also brings up call and message options, along with options to Add to Existing Contact or Create New Contact.

In a similarly complicated set of steps involving an invisible user menu, an attacker can eventually access a locked iPhone's Camera Roll and other photo folders, which can then be used to add profile pictures to contact cards.

The bypass methods work on all iPhones including the iPhone XS lineup, but Apple doesn't appear to have fixed the vulnerabilities in the latest iOS 12.1 beta. Thankfully however, all of the above can be easily prevented by disabling access to Siri from the lock screen.

Concerned users can do so by navigating to Settings > Face ID & Passcode (that's Settings > Touch ID & Passcode on iPhones with Touch ID) and disabling the Siri toggle under the "Allow access when locked" menu.

Article Link: Complex Passcode Bypass Method Exposes iPhone Contacts and Photos in iOS 12

 

[SBlue1]

How do they find out something like this??

 

[Scottsoapbox]

Hats off to hackers and security people that have much more patient for minutiae than me.

 

[MrGimper]

Surely this must have been discovered in some reverse-engineering of iOS. How else would you ever find this.

 

[BaccaBossMC]

How do they find out something like this??

Surely this must have been discovered in some reverse-engineering of iOS. How else would you ever find this.

Youtuber EverythingApplePro reported that it was found by a taxi driver who tries to discover bugs like this on his iPhone while waiting for passengers.

 

[Scotty2Hotty]

"convoluted" and "complicated" to say the least

 

[MrGimper]

Youtuber EverythingApplePro reported that it was found by a taxi driver who tries to discover bugs like this on his iPhone while waiting for passengers.

He's also famous for being the taxi driver who has one customer every 10 years.

 

[idmean]

The home screen at the beginning of the video looks odd: Apps centered at the bottom of a page?

 

[4jasontv]

The home screen at the beginning of the video looks odd: Apps centered at the bottom of a page?

Good eye, it’s a optical illusion mixed with a little trick. All the spaces that seem missing are really just safari web links to a page that shows a white image. If the wallpaper was changed you would see white squares. You could do this with any color, and if you had a lot time and even more patience you could also do this with a graphic....

 

[mistasopz]

Well I guess it’s more complicated than the no-password root exploit that surfaced recently, but still... I expect better than this Apple.

 

[now i see it]

If a bored guy sitting in a Taxi can find vulnerabilities like this, gotta wonder what government sponsored hacking professionals have found but kept quiet.

 

[alphaod]

Well it's always a game of security versus convenience.

I know a lot of people still use prefer 4-digit passcodes even when iOS now defaults to 6-digit passcodes. These same thing have TouchID/FaceID enabled, so there you go.

 

[luvbug]

I know I had my Siri setting turned off already. I hope the default is "off". I can't imagine having Siri access "on" by default from the lock screen as being preferred, from a security standpoint.

 

[cloudyo]

I deactivated Siri on the lock-screen, so, fixed?

 

[MauiPa]

How do they find out something like this??

The new rubik's cube!

 

[Kabeyun]

What’s with the pen tapping?

 

[I7guy]

Control center and Siri are always disabled from lock screen for me. Surprised these vulnerabilities still exist.

 

[cbr600]

I think there’s something missing here. “Hey Siri” only activates to the user who sets it up. A person can’t activate that feature as described in the write up. Or he is just describing how to bypas something on his own iPhone. An issue but not such a big deal...

 

[posguy99]

I deactivated Siri on the lock-screen, so, fixed?

Why in the world do people have Siri enabled on the lock screen in the first place? The only thing worse would be the truly clueless who enable control center on the lock screen.

 

[C DM]

Why in the world do people have Siri enabled on the lock screen in the first place? The only thing worse would be the truly clueless who enable control center on the lock screen.

Helps in various situations like calling or doing something while driving, or jogging or something else of that nature.

 

[posguy99]

I think there’s something missing here. “Hey Siri” only activates to the user who sets it up. A person can’t activate that feature as described in the write up. Or he is just describing how to bypas something on his own iPhone. An issue but not such a big deal...

No one mentioned "Hey Siri". Enabling access to Siri on the lock screen doesn't have anything to do with whether you're allowing "Hey Siri".

 

[Apple_Robert]

If I am not mistaken, this vulnerability has been reported in a past version of iOS (albeit it wasn't the exact step for step bypass) and was quickly patched.

 

[cbr600]

Well, allow Siri when locked only shows on settings when listen for Hey Siri is enabled.

 

[posguy99]

Well, allow Siri when locked only shows on settings when listen for Hey Siri is enabled.

Except it shows all the time, of course. I certainly don't allow "Hey Siri" on my device, and there's the slider for Siri in "Allow Access When Locked", right where it's supposed to be. Toggling it on doesn't enable "Hey Siri", either.

On the 7 and later, you don't (supposedly) have to be plugged into power to use "Hey Siri", but that shouldn't change where and when the option(s) show up in the UI.

 

[davidg4781]

Why in the world do people have Siri enabled on the lock screen in the first place? The only thing worse would be the truly clueless who enable control center on the lock screen.

So when I’m cooking, I can just yell “Hey Siri, set a timer for 2 and one-half minutes!” and not be bothered by picking it up.

Or when I’m driving, just say “Hey Siri, tell dad I’ll be there in five minutes.” Since Apple doesn’t feel it can leave iPhone on while plugged in listening to music.

Now, serious question, what’s wrong with Control Center being enabled on lock screen?