Security Flaw in iOS 9.3.1 Allows Access to iPhone Photos and Contacts

[BrodieApple]

Thank you.
Voice control wasn´t disabled, but even after disabling i can still start voice control from the blocked screen.
It seems that this access cannot be blocked.

I have to leave you for some hours (I have to work a little bit) and will come back here again.

Yeah there's nothing to worry about with voice control because it's not connecting to the Internet. Also the reason it called someone when you said hey siri is because voice control won't do anything if what you said didn't make sense to it, it'll just match up your words to whatever it closely sounded like.

 

[6836838]

I may be one of the few who feels this way, but I don't allow anything from my lockscreen - Siri, notifications, or otherwise. Never have, even when I used to JB and tweak like crazy, and especially not now that coked-out Touch ID is here.

Siri just told me to unlock my iPhone first when I asked her to Search Twitter on the lock screen.

First do it when unlocked, then add your account and then try again when locked.

 

[iZac]

...Good job I turned Siri off years ago.

 

[crashoverride77]

Can't reproduce it running iOS 8.4.1 on my iPhone 6. Glad I can't upgrade now.

That makes total sense, stay on an older OS with a lot more security issues because the newest OS update has 1 new security flaw.

 

[rsdotscot]

but Apple keeps missing stuff

This is what happens with large, complex software developments. There's only so much testing can be done before release otherwise the release would never come, after which any discovered holes are dealt with as they crop up.

 

[Elijen]

True. I believe it only works properly with English speakers.

I think it can learn your accent pretty well. Just need a bit of time where you are manually correcting what Siri understands. But yeah still seems like most of the tasks are faster done manually instead of dealing with Siri ... especially when she answers "Sorry I can't do that" on half of the requests.

 

[crashoverride77]

This is what happens with large, complex software developments. There's only so much testing can be done before release otherwise the release would never come, after which any discovered holes are dealt with as they crop up.

Don't bother, most people have no clue about this. I wish those people would try to write a simple iOS app with a few 1000 lines of code and see how bug free it will be.
Now multiple this by millions of lines of code for a whole OS and it doesn't matter how much money and developers Apple has, bugs will always be there.
This is not an excuse for some obvious bugs that should not be there but some people think it's the easiest thing in the world to write an OS.

 

[vatter69]

Who uses Siri anyway? I've disabled it since it doesn't offer much to German speaking people like me.

Hey Siri - create new reminder - 30 mins - take beer ouf of the freezer. Always great on BBQs Beside that - pretty much agree yep.

 

[Unregistered 4U]

So, basically it works only under a small subset of non-default conditions?

That's my thought, too. I'm having a hard time seeing this as a bug, more as the expected outcome when you make configuration changes that allow you to use the device in the way you like.

 

[Dangerous Theory]

What really has me at a loss is how people actually find these things out. Some of them are quite convoluted.

I think there are people out there desperate to prove that Apple has not considered all possible permutations of accessing information on your phone. There is also a good chance that people just accidentally come across these things when messing around with Siri.

 

[The.Outsider]

Outstanding!! Another hit in the face... man... I miss my old iPhone 5, the one that came with the original iOS installed on it... it was perfect, fast and reliable. Now on my iPhone 6, I've got the strangest things happening on it. I get to 56% and it turns off... bam! Only way to get it back to life is if I plug it into the wall. I think it's a software issue since it happened on the iPhone 5... But yes, more testing from Apple would save everyone headaches in the future.

PS. Anyone here who went from Apple to Windowz for Video Editing? If so, which one would you recommend? I find working on an Apple lately is hard as it's not good enough handling 4K videos or HD even. I use Final Cut but might have to consider moving to Premier?

 

[MH01]

Don't bother, most people have no clue about this. I wish those people would try to write a simple iOS app with a few 1000 lines of code and see how bug free it will be.
Now multiple this by millions of lines of code for a whole OS and it doesn't matter how much money and developers Apple has, bugs will always be there.
This is not an excuse for some obvious bugs that should not be there but some people think it's the easiest thing in the world to write an OS.

A better example is someone trying to write code, when the marketing team creates the scope and timelines. As a developer you are forced to cut corners to meet those deadlines and hence bugs result. Hence current software quality to meet major iOS/os x updates annually.

 

[djcerla]

Outstanding!! Another hit in the face... man... I miss my old iPhone 5, the one that came with the original iOS installed on it... it was perfect, fast and reliable. Now on my iPhone 6, I've got the strangest things happening on it. I get to 56% and it turns off... bam! Only way to get it back to life is if I plug it into the wall. I think it's a software issue since it happened on the iPhone 5... But yes, more testing from Apple would save everyone headaches in the future

Quite simply, the battery is defective, and Apple will replace it free of charge if your iPhone 6 is under warranty.
It's not always doom and gloom.

 

[wacky4alanis]

Whenever I ask Siri to search for anything on Twitter, the first thing it asks is for me to unlock my iPhone first... Unless of course I invoked Siri with my finger (in which case the phone already becomes unlocked with my fingerprint). And doesn't the guy in the video unlock his phone before he does anything?? Am I missing something?

 

[GoodWheaties]

What annoys me is that there is no way no make notifications anonymous. It would be nice to just read that there is a message, without names or content displaying on the screen. Androids can do that.

You actually can set it to not show content, but I don't think you can not show the contact unfortunately.

 

[dk001]

Tim Cook wants no backdoors but Apple keeps missing stuff... so who knows. There may actually still be another backdoor. Tim Cook and Co just don't know where to look for what LOL

Doesn't seem to take much to get Siri to display her/his/it unmentionables these days.

 

[Tech198]

Looks bad...... Dam u Apple..... But as i've said, u have something else to exploit, in this case 3D Touch..

What give us more convenience also introduces more security issues, and this doesn't one look so good. Lucky i don't have any of these.

I knew it was a bad idea to give quick access to your contact list..

 

[GoodWheaties]

What I mean?I NEVER EVER Used Siri and I DISABLED IT.

And nevertheless - after my iPhone locked itself after a minute, I just pressed the home-button for some seconds from that "securized" and "locked" screen, the GUI of Siri appeared and - for the very first time - I just said "hey Siri!" - and Siri just told me "I connect yyou with xyz" and I found myself on the GUI of the phone-call and was connected!!!

Again:
1) I DISABLED SIRI !
2) I NEVER used Siri!
3) I could nevertheless start Siri just by simply pressing the home button and it started immediately after I just said "Hey Siri!" to connect me with someone from my contacts !!!

Is this difficult to understand??

There is a BIG SECURITY BUG indeed !!!
you press the home button shortly: You have to tap your passcode.
you press the home button for some seconds: the iPhone under IOS 9.3.1 starts SIRI although disabled, and Siri connects you immediately with someone after you just said "hey Siri!" and you find yourself on the same GUI as you do if you call intentionally someone !!!

When you disable Siri it switches back to on-device Voice Control, which is not as accurate and it would make sense what happened to you.

 

[lah]

This works for me - I'm on a 6S running 9.3.1. Was able to access photos w/o a problem.
Not good Apple.

 

[dk001]

I think there are people out there desperate to prove that Apple has not considered all possible permutations of accessing information on your phone. There is also a good chance that people just accidentally come across these things when messing around with Siri.

Then for others it is their job. Or maybe a hobby. Or ...
I really don't care how they find them. I am just glad they are found and that they can be addressed.

 

[dxmac99]

I am finally convinced QA and making GREAT products are not on TC's top list. Let's see how long it will take he to make this once (or twice) greatest company dull again.

 

[hleewell]

Add Voice recognition feature maybe? Only owner's unique voice can summon Siri.

 

[nia820]

Wasn't there a post like 2 days ago that said 9.3 was the most stable ios update. Lol.

And people are wondering how FBI broke their encryption. Apple is not as secure as they present themselves. Nothing is nowadays.

 

[Thunderhawks]

This is what happens with large, complex software developments. There's only so much testing can be done before release otherwise the release would never come, after which any discovered holes are dealt with as they crop up.

As somebody mentioned it is quite convoluted to do this.
So, how is Apple to test for that?

It seems that whatever conveniences are being created, there is always a way to bypass and/or misuse it for something else.

Since I am extremely mediawise asocial (no face book, twitter, instagram, linkedin etc.etc.) or subscribe to the philosophy that nothing needs instant attention, I can't see this as a bug or a big problem.

As long as you have your phone in your possession, nothing happens to begin with.

Too much paranoia and people trying to fault Apple for the tiniest things.

Rest assured this issue will be solved and we can go on to the next hyped "bug", like texting 121684 to a place in Nigeria, which then deducts $ 5,000 from your bank account.

 

[nt5672]

Give Apple a year, they will get it right eventually

It depends on what is in the marketing pipeline. If there is no next big thing, then yes the good software engineers will be allocated to work on the problem. If there is a next big thing then the small staff that they have that can actually write good code will be working in the next big thing, not existing flaws. That is the Apple DNA.