Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

I have just discovered a major security flaw in iOS 6.1

robbyg said:
Find my iPhone is really a mess. It needs these two fixes.

2) It should have worked with the phones serial number or CID so that once you register it the phone remains trackable by you and only you, unless you decide to login into Apple and release the number when your selling or giving away the phone.

If those two things where done it would not matter what the thief did because sooner or later he will have a Sim in the phone or wifi connected and Pow you know exactly where he is and if you can't get your phone back because he's in Nigeria, etc. You will still be able to remotely wipe his phone every week or so just to piss him off.
Click to expand...

THIS! This is smartest idea I've ever read on macrumors. C'mon apple, do it!
 
dictoresno said:
LTE is based on GSM technology, which requires network authentication using a SIM. so they have integrated its need into the iphone 5. without it, it will render even the CDMA side useless.
Click to expand...

Thanks for the information. Didn't have a clue.
 
S1RiOS said:
Thanks friends, the flaw is also present in iOS 6.0.1 and 6.0.2 I have 10B5126b 6.1 but I'm not developer, I do not know how to inform to Apple, I hope Apple is reading this and contact me.
Click to expand...

Have you tried actually emailing them, or initiating any form of contact at all (support case, etc?)


Failing that report it to CERT who will then probably contact apple and publish a security advisory if they can replicate the issue.
 
robbyg said:
Find my iPhone is really a mess. It needs these two fixes.

1) It should have been integrated into the ios like the weather app or any of the others, that way it could not be removed and it should have no Off mode, that should be something that can only be done on the net when you log into the account.

2) It should have worked with the phones serial number or CID so that once you register it the phone remains trackable by you and only you, unless you decide to login into Apple and release the number when your selling or giving away the phone.

If those two things where done it would not matter what the thief did because sooner or later he will have a Sim in the phone or wifi connected and Pow you know exactly where he is and if you can't get your phone back because he's in Nigeria, etc. You will still be able to remotely wipe his phone every week or so just to piss him off.
Click to expand...

What if location services are turned off?
 
C DM said:
Is it really a (security) flaw or perhaps just some possibly misunderstood yet valid usecase?

Especially when it comes to "simple and easy to pull off trick", far too many times people have mentioned security flaws and it simply turned out to be nothing more than a misunderstanding or a particular phone/app configuration of some sort, and certainly not a flaw, let alone a (major) security one.
Click to expand...


Not so, friend. My iPhone is clean, recently updated to version 6.1 beta 4, and I've tried the trick in a 4S and iPhone 5 with the same result. If anyone in the JB world can take advantage ... I do not know.
Maybe Apple's enemies are interested it to be released, but I am an iPhone lover and I'll contact Apple soon for fix it.

----------
Starrbuck said:
If he's got 6.1, isn't that a beta, and that would mean he's a developer, right? I would think Apple makes it clear how they report bugs.
Click to expand...

I am not a developer, anyone can update to 6.1 beta version, there are many tutorials.
 
S1RiOS said:
Not so, friend. My iPhone is clean, recently updated to version 6.1 beta 4, and I've tried the trick in a 4S and iPhone 5 with the same result. If anyone in the JB world can take advantage ... I do not know.
Maybe Apple's enemies are interested it to be released, but I am an iPhone lover and I'll contact Apple soon for fix it.

----------



I am not a developer, anyone can update to 6.1 beta version, there are many tutorials.
Click to expand...

Just tell us how to do it.
 
S1RiOS said:
This simple and easy to pull off trick allows for an attacker to bypass an iPhone's pass code and obtain full access (see and edit) to contacts list, list of recent calls, favorite contacts, and even make a call to any phone number on the hacked device and erase the log.
Should I shut up? or should I publish the trick for the iPhone users are prevented?
Click to expand...

Guys this guy is brand new on here.
 
robbyg said:
Find my iPhone is really a mess. It needs these two fixes.

1) It should have been integrated into the ios like the weather app or any of the others, that way it could not be removed and it should have no Off mode, that should be something that can only be done on the net when you log into the account.

2) It should have worked with the phones serial number or CID so that once you register it the phone remains trackable by you and only you, unless you decide to login into Apple and release the number when your selling or giving away the phone.

If those two things where done it would not matter what the thief did because sooner or later he will have a Sim in the phone or wifi connected and Pow you know exactly where he is and if you can't get your phone back because he's in Nigeria, etc. You will still be able to remotely wipe his phone every week or so just to piss him off.
Click to expand...

all of that... but i also want to be able to switch on the camera and the mic so i can see what the phone can see :D
 
S1RiOS said:
Thanks friends, the flaw is also present in iOS 6.0.1 and 6.0.2 I have 10B5126b 6.1 but I'm not developer, I do not know how to inform to Apple, I hope Apple is reading this and contact me.
Click to expand...

And if you're not a dev how'd you come to have iOS 6? There are very clear T&C's for all dev's regarding unauthorized device usage.

Anyway I'm a dev and can report the issue via the portal, can you PM it to me?
 
find my iphone is totally useless if somebody steals your phone. The only way you can then track the phone is by its IMEI code via network operator... so yes, apple should make this thing a little more usefull. Unless they like that peoples iphone's get stolen so they have to buy a new one:rolleyes:
 
Smartass said:
find my iphone is totally useless if somebody steals your phone. The only way you can then track the phone is by its IMEI code via network operator... so yes, apple should make this thing a little more usefull. Unless they like that peoples iphone's get stolen so they have to buy a new one:rolleyes:
Click to expand...

This is one of, if not THE BEST, reasons to jailbreak currently. Cydia apps like "IGotYa" prevent the iPhone from being powered off on the lock screen. So if you set your iphone to automatically lock every minute, there will be no way for the thief to turn off the phone. While it's true that ejecting the SIM card will indeed make an iphone impossible to track, most thiefs don't know this much less have a paper clip available the moment they're stealing your phone. This gives you a huge head start in tracking the device before they can hook it to a computer to wipe it.

Recently I was robbed by two teenagers who placed a semi-automatic gun to my face near Sony Pictures studios in the early evening. Right by a police station, no less. The douchbags who made off with my phone weren't able to turn it off, obviously freaked out about it, and threw it into the side of a freeway overpass. I tracked it with Find My iPhone, called the police who were searching that area for evidence, sent a lost beep sound to it, and it was recovered. There would've been no possible way to have done that if the phone was able to have been turned off the moment it was stolen. I would've been out $700.

Apple should definitely add a 'prevent OFF' when the iPhone is in the lock screen option. Until then, I'm buying theft insurance with my next iPhone. It's not worth getting killed over.:rolleyes:
 
I can't believe people are replying to this attention seeking thread?

I can't believe I'm replying?

I can't believe I'm still here typing.
 
S1RiOS said:
Not so, friend. My iPhone is clean, recently updated to version 6.1 beta 4, and I've tried the trick in a 4S and iPhone 5 with the same result. If anyone in the JB world can take advantage ... I do not know.
Maybe Apple's enemies are interested it to be released, but I am an iPhone lover and I'll contact Apple soon for fix it.

----------



I am not a developer, anyone can update to 6.1 beta version, there are many tutorials.
Click to expand...
None of that really says much whether or not what you think you have come across is really a flaw, that is actually a security flaw, and a major one at that. Without some more information about it it's really hard to say that it is that or might even be that.

As mentioned, in the past people have also came out to talk about major security flaws only to realize that what they were observing (even trying different phones, etc.) was something that was just configured in a way that they didn't realize, or something along those lines, and far from a major security flaw, or even really a flaw.
 
C DM said:
None of that really says much whether or not what you think you have come across is really a flaw, that is actually a security flaw, and a major one at that. Without some more information about it it's really hard to say that it is that or might even be that.

As mentioned, in the past people have also came out to talk about major security flaws only to realize that what they were observing (even trying different phones, etc.) was something that was just configured in a way that they didn't realize, or something along those lines, and far from a major security flaw, or even really a flaw.
Click to expand...
Ok, I'm going to show through a video by PM, that it is a major security flaw, but I will not explain "how to" do it.
I have already contacted Apple and am waiting for feedback, but, anyway, is also posted in this thread of the existence of the fault, and if Apple wants to fix it, they can simply ask me how it is produced.
Thank you very much to everyone for helping me decide and if the flaw persists, I will surely put it in your knowledge.
 
Mlrollin91 said:
How exactly is that a major security flaw? So they have access to the phone? I think a larger flaw is being able to turn off the phone when locked, therefore Find My iPhone does not work and the potential for it to be restored and never found.
Click to expand...

has something changed? when has find my iphone not worked when the phone is off? I've tried find my iPhone with my iPhone turned off and it still worked...
 
SAD*FACED*CLOWN said:
has something changed? when has find my iphone not worked when the phone is off? I've tried find my iPhone with my iPhone turned off and it still worked...
Click to expand...

Its posting the last signal when the device was on. When the device is fully powered off or the battery dies and then moves away from the last known position it will stop updating and not send a "true" signal.
 
S1RiOS said:
Ok, I'm going to show through a video by PM, that it is a major security flaw, but I will not explain "how to" do it.
Click to expand...

That's not evidence. If you're not showing how it's done, then whoever looks at that video has no clue what caused whatever it is you claim the iPhone is doing.
 
scaredpoet said:
That's not evidence. If you're not showing how it's done, then whoever looks at that video has no clue what caused whatever it is you claim the iPhone is doing.
Click to expand...

I have not yet heard that Apple will do something about it.

What do you think?
 
Last edited:
So, is the supposed flaw there in the final version of iOS 6.1? What's the latest in relation to this?
 
I doubt there was a real flaw, probably a kid trying to get attention/troll.

No tangible information was given and he was sketchy about the topic.

I could be wrong though.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back