Major Security Flaw in 2.0.2

[JML42691]

I'm gunna go out on a limb here, but who has access to MR news submissions?

He IS a Demi-God. Does that give him access? That would be how he copied it. 😉

I don't even think that moderators have access to them, only gods (which is about 5 people).

 

[Inukami]

This was shown on G4 AOTS =D

 

[almasinfe]

inter esting

i dont know if this was posted but when i was trying to make the glitch happen i was listening to the ipod and it would not let me crack it so if you just had your ipod running all the time i would stay locked 😎

 

[alFR]

Actually, neither of you found it first. According to Daring Fireball it was a known bug in the v1 firmware that was fixed in v1.1.3, as detailed in this advisory:

Passcode Lock
CVE-ID: CVE-2008-0034
Available for: iPhone v1.0 through v1.1.2
Impact: An unauthorized user may bypass the Passcode Lock and launch
iPhone applications
Description: The Passcode Lock feature is designed to prevent
applications from being launched unless the correct passcode is
entered. An implementation issue in the handling of emergency calls
allows users with physical access to an iPhone to launch an
application without the passcode. This update addresses the issue
through an improved check on the state of the Passcode Lock.

Apparently the fixed code didn't make it into the newer firmware. Can we stop arguing about who reported it first now, please? 🙄

 

[xUKHCx]

No problem, it just ceases to amaze me as to how stubborn some people can be, it is just a coincidence. And if this user actually cared, then they would have made their own thread when they found it.

Just a coincidence, seriously? Are we supposed to believe that two separate people happened to use the exact same wording/phrases/punctuation as well as examples. There is no way that this could be the case and there is not point in arguing against the evidence. It is so patently obivous I can't see why anyone is denying it.

Apparently the fixed code didn't make it into the newer firmware. Can we stop arguing about who reported it first now, please? 🙄

The argument is about whether or not the OP copied the words/work of hdm42 and the evidence presented in this thread more than shows it is the case.



So apple previously fixed this bug but then got rid of the fix and reintroduced the bug. Surely they have a database of known issues to check for when coding the update. Seems a bit sloppy to me, or at least bad design.

 

[JML42691]

Just a coincidence, seriously? Are we supposed to believe that two separate people happened to use the exact same wording/phrases/punctuation as well as examples. There is no way that this could be the case and there is not point in arguing against the evidence. It is so patently obivous I can't see why anyone is denying it...

As of right now, there is no proof that you can look at it as any more than a coincidence. I am believing that two people wrote nearly the same thing, as there is no connection between hdm42's report posts online, and greenmymac's thread here. It is not like greenmymac could have found this on a website and just copy/pasted it, hdm42 never posted this on a public page that greenmymac would have had access to.

And how am I arguing against the evidence? There is no evidence of how greenmymac would have got the report posts submitted by hdm42, and until there is, there is no evidence against him, and I will stick to my side on this. Now if somebody were to provide an explanation as to how greenmymac could have found hdm42's wording, and if it were to be completely valid and believable, then I would accept that I would have been arguing a false side and that I was wrong, but until that happens, I will continue to defend greenmymac on this issue, as he is being accused of doing something, while there is no possible way that he could have done it.

 

[greenmymac]

As of right now, there is no proof that you can look at it as any more than a coincidence. I am believing that two people wrote nearly the same thing, as there is no connection between hdm42's report posts online, and greenmymac's thread here. It is not like greenmymac could have found this on a website and just copy/pasted it, hdm42 never posted this on a public page that greenmymac would have had access to.

And how am I arguing against the evidence? There is no evidence of how greenmymac would have got the report posts submitted by hdm42, and until there is, there is no evidence against him, and I will stick to my side on this. Now if somebody were to provide an explanation as to how greenmymac could have found hdm42's wording, and if it were to be completely valid and believable, then I would accept that I would have been arguing a false side and that I was wrong, but until that happens, I will continue to defend greenmymac on this issue, as he is being accused of doing something, while there is no possible way that he could have done it.

I love how forums turn a true issue into a personal issue..... LOL

 

[theunlocker]

Unbelievable. They better fix it or there's going to be some unhappy customers who got their phone stolen and are being used as we speak.

 

[greenmymac]

You have to have it set to open favorites

 

[GradientMac]

Just a coincidence, seriously? Are we supposed to believe that two separate people happened to use the exact same wording/phrases/punctuation as well as examples. There is no way that this could be the case and there is not point in arguing against the evidence. It is so patently obivous I can't see why anyone is denying it.



The argument is about whether or not the OP copied the words/work of hdm42 and the evidence presented in this thread more than shows it is the case.



So apple previously fixed this bug but then got rid of the fix and reintroduced the bug. Surely they have a database of known issues to check for when coding the update. Seems a bit sloppy to me, or at least bad design.

Thank you. That's what I've been trying to say.

 

[TheSpaz]

Thank you. That's what I've been trying to say.

Nobody has shown real proof yet that he actually stole your heavily guarded words. If nobody else could see them but the forum GODS, then how did he get them?

 

[John-S]

Not sure why yours wouldn't (maybe something to do with the water damage, maybe you were trying to sync to a different computer?) but I have my iPhone (v1 but latest firmware) set to autolock the screen after 1 minute, password protected, and every time I plug it into my mac it syncs (including offloading photos) without me having to type the passcode to unlock the screen first. I plug it in, the "Sync in progress" screen comes on, it syncs. That's the way it's always worked.

If you do forget the passcode you can reset it by doing a restore in iTunes and regain access to the phone (this is documented in the users guide). That wipes the data, of course, but as I said you should be able to sync to the computer your phone is paired with without the code.

It will sync your existing photos yes, but not the ones from your new camera roll and I am referring to the original synced computer. It won't download those which was my problem. To do that you have to enter a password and it has always been like this in the past. Here is the official apple article on it that I used almost a year ago (its been updated to include the iphone 3g I think since):

http://support.apple.com/kb/TS1499

The password thing has nothing to do with water damage... its just the way the phone works.

 

[CocheseUGA]

Nobody has shown real proof yet that he actually stole your heavily guarded words. If nobody else could see them but the forum GODS, then how did he get them?

That's not the person in question.

You still have to question two things that are virtually identical. Evidence be damned.

 

[ilugram]

Apple's temp solution doesn't really work

Apple has recommended that people simply change the double click on home button option to "Home" or "Ipod" to stop the security problem

This does solve the problem of people getting into your data, however when the phone is locked, you can still go to emergency call.

It appears however that the phone can't tell whether you are dialing an emergency number or any other number, meaning any phone call can be made. Hopefully they fix this too with the next update

 

[hdm42]

Apple has recommended that people simply change the double click on home button option to "Home" or "Ipod" to stop the security problem

This does solve the problem of people getting into your data, however when the phone is locked, you can still go to emergency call.

It appears however that the phone can't tell whether you are dialing an emergency number or any other number, meaning any phone call can be made. Hopefully they fix this too with the next update

I could be mistaken, but I believe emergency calls are limited to five minutes.

 

[sh0ckerturb0]

who gives a flying **** who found out about this first?

 

[smkkm5]

Wow this stuff is serious!!

 

[StingerT125]

It appears however that the phone can't tell whether you are dialing an emergency number or any other number, meaning any phone call can be made. Hopefully they fix this too with the next update

I don't think this is a problem. An emergency call could be to something other than a 911 type number. How would the phone know what numbers to limit to?

 

[baaron]

<apple developers>Oops!</apple developers>

 

[outaru]

my nokia is even more secure than my iphone.. shame... 😡

 

[arn]

Hi guys, to clarify some things...

Contributors ("demi-gods") have had access to raw news submissions with identifying information stripped out. It was an un-advertised benefit of contribution which is no longer offered.

As a result, greenmymac did have access to the submission information. Based on the similarities and timing, it seems very likely that hdm42 was the source of this post. (for what it's worth, I did know of someone else who had reported this to apple a few weeks ago).

I'll change the original post to reflect this, and greenmymac will be disciplined as determined appropriate for misuse of this information.

Sorry for the confusion, and I would ask that we try to prevent this thread from getting out of hand.

arn

 

[GradientMac]

Thanks for clearing this up Arn.

 

[alphaod]

So can we lock this thread?

 

[TheSpaz]

Hi guys, to clarify some things...

Contributors ("demi-gods") have had access to raw news submissions with identifying information stripped out. It was an un-advertised benefit of contribution which is no longer offered.

As a result, greenmymac did have access to the submission information. Based on the similarities and timing, it seems very likely that hdm42 was the source of this post. (for what it's worth, I did know of someone else who had reported this to apple a few weeks ago).

I'll change the original post to reflect this, and greenmymac will be disciplined as determined appropriate for misuse of this information.

Sorry for the confusion, and I would ask that we try to prevent this thread from getting out of hand.

arn

There's the proof we've been looking for!

 

[robertlk]

Seems to be a false rumor

I just tried to replicate this on my original iPhone running OS 2.0.2 (5C1). I have contacts assigned as favorites and a lock code assigned. Pressing the "Emergency Call" button takes me to the Emergency Call screen as it should. Several rapid presses of the Home button simply takes me back to the Enter Passcode screen.