Security Flaw in iOS 9.3.1 Allows Access to iPhone Photos and Contacts

[djcerla]

Never is a long time. But Apple can do much better than it's doing now. Apple is far from 100% perfect, and you'd agree with that I'm sure.

Yearly iOS updates are stretching the resources of the iOS team to the limit and quality/reliability/security suffer as a result.

Apple needs to completely freeze all development on new features for iOS for at least a year and assign its entire iOS team to do a top down review/quality check of the entire iOS codebase.

That's what needs to happen here.
[doublepost=1459871282][/doublepost]

I'm wrong? Who said anything about "rewriting all the code"?

I'm saying to have the iOS team do a complete top/down review of the entire iOS code base. Fix all known issues. Catch as many unknown ones as you can without the pressure of an annual development cycle for a new iOS release.

You are grossly overestimating the number of unresolved known issues in iOS. How many people in the real world will be affected by this? Probably zero, on a billion active devices.

Apple will fix very quickly this minor issue, no need to freeze everything to appease some folks online.

 

[ehrman]

I have a 6s Plus with 9.3.1 and I can't reproduce it at all. Every time i do it I get asked for my passcode. If it truly is a flaw in the OS it would show up in all devices running it would it not?

I keep reading comments in which people discount this bug or claim to have protected themselves from it. I thought I was protected from it too until I just tried it exactly the way it was described. I have a 6s Plus. You have to ask to search twitter in one Siri command. Search for @yahoo in the next command, click on the same handle in the photo, force click and then add to existing contact. It works every time. I don't have twitter installed so there is nothing for me to disable in the twitter privacy settings. I don't even have a twitter account and I can still access all my contacts and photos without unlocking my phone. I really can't find a way to block the bug at all without completely disabling siri maybe. More people need to try this before assuming they're safe.

 

[garylapointe]

Just because Apple has done yearly updates doesn't mean they have to keep doing them.

I'm wondering if it would affect sales if they skipped a year just didn't come out with iOS 10 until next year?

Some of the times with their updates, I've wondered if they really should have updated the number by 1 or if it should have gotten a 0.1 increase (0.5?)

Gary

 

[IPPlanMan]

You are grossly overestimating the number of unresolved known issues in iOS. How many people in the real world will be affected by this? Probably zero, on a billion active devices.

Apple will fix very quickly this minor issue, no need to freeze everything to appease some folks online.

Zero? Are you serious?

 

[MrAverigeUser]

Confirmed, this is real! I'm on 9.3.1. Just say 'Search twitter for gmail.com'. Then click a tweet with an email address and force-press it.

It's not related to Voice Dialling. Just make sure twitter has previously been able to work with twitter before locking and checking.

Thank you for confirming…

it is NOT nice to be called a liar - just because one tries to warn other users…

I made a joke about jealous wifes - but you can destroy existances and carreers by only have some minutes alone with the iPhone of someone you hate… imagine that the person receiving the call YOU (and NOT the owner) identifies you as the REAL owner - next day you see the man that should get your superior leave the building for the last time - he got fired because you insulted the boss (pretending to be very drunken) using his phone and in his name…. or his wife or…. this Issue IS DANGEROUS!

Time for the apple-apologists to apologize …. I am NOT A LIAR !!

 

[HiRez]

Reducing the Touch ID timeout period seems like a better interim solution, instead of disabling Twitter's access to photos, which you presumably want if you had it turned on.

 

[MrAverigeUser]

I'm wondering if it would affect sales if they skipped a year just didn't come out with iOS 10 until next year?

Some of the times with their updates, I've wondered if they really should have updated the number by 1 or if it should have gotten a 0.1 increase (0.5?)

Gary

FOR ONE TIME having a safe IOS would be a good idea…. and people like me would restart to get a little bit more confiance on apple software…. my confidence is in free fall… I wanted to buy a SE until May - but I will wait.

If this endless buggy IOS goes on I will go back to competitors… I have enough...
[doublepost=1459873383][/doublepost]

That makes total sense, stay on an older OS with a lot more security issues because the newest OS update has 1 new security flaw.

ahhh! So you finally admit that there IS a security flaw? Doesn´t stop you from ongoing apologizing - you are a real apple fan...

 

[crashoverride77]

A better example is someone trying to write code, when the marketing team creates the scope and timelines. As a developer you are forced to cut corners to meet those deadlines and hence bugs result. Hence current software quality to meet major iOS/os x updates annually.

Well that too, still even having all the time in the world doesn't automatically mean no bugs.
[doublepost=1459874157][/doublepost]

FOR ONE TIME having a safe IOS would be a good idea…. and people like me would restart to get a little bit more confiance on apple software…. my confidence is in free fall… I wanted to buy a SE until May - but I will wait.

If this endless buggy IOS goes on I will go back to competitors… I have enough...
[doublepost=1459873383][/doublepost]
ahhh! So you finally admit that there IS a security flaw? Doesn´t stop you from ongoing apologizing - you are a real apple fan...

I think you embarrassed yourself enough today.

 

[rodavilla]

It appears to be a security flaw in that you seem to be able to edit contacts... that's a data breach.

It is only a data breach if it can edit contacts WITHOUT your permission. In this case, it needs your permission first. So it is not a data breach. It is simply a function that occurs when you, and only when you, give it permission to do so.

 

[MrAverigeUser]

As somebody mentioned it is quite convoluted to do this.
So, how is Apple to test for that?

It seems that whatever conveniences are being created, there is always a way to bypass and/or misuse it for something else.

Since I am extremely mediawise asocial (no face book, twitter, instagram, linkedin etc.etc.) or subscribe to the philosophy that nothing needs instant attention, I can't see this as a bug or a big problem.

As long as you have your phone in your possession, nothing happens to begin with.

Too much paranoia and people trying to fault Apple for the tiniest things.

Rest assured this issue will be solved and we can go on to the next hyped "bug", like texting 121684 to a place in Nigeria, which then deducts $ 5,000 from your bank account.

This is complete BS: I am like you: NO Facebook, no Twitter, no what´s up or whatsoever.
I just use my iPhone as a phone, with a contact list, take some photos and have alitttle bit of music on it. some simple apps like Sonos and deezer, that´s it.

AND I DISABLED nearly EVERYTHING, especially Siri and no also voice control. BUT I can prove that even with disabled voice control you can at least call someone and - if you have enough time test any name with voice control to control if this name exists in the contact list and you can call them "in the name of the owner"…

I´d call that a BIG SECURITY and PRIVACY ISSUE!!!

I could prove that anybody can access your iPhone - this is NOT PARANOIA, this is REALITY, my friend.

Just press the home button - and you are free to use anyone´s phone…

This is a shame AGAIN for apple.

 

[crashoverride77]

This is complete BS: I am like you: NO Facebook, no Twitter, no what´s up or whatsoever.
I just use my iPhone as a phone, with a contact list, take some photos and have alitttle bit of music on it. some simple apps like Sonos and deezer, that´s it.

AND I DISABLED nearly EVERYTHING, especially Siri and no also voice control. BUT I can prove that even with disabled voice control you can at least call someone and - if you have enough time test any name with voice control to control if this name exists in the contact list and you can call them "in the name of the owner"…

I´d call that a BIG SECURITY and PRIVACY ISSUE!!!

I could prove that anybody can access your iPhone - this is NOT PARANOIA, this is REALITY, my friend.

Just press the home button - and you are free to use anyone´s phone…

This is a shame AGAIN for apple.

Keep digging the hole deeper and deeper. It's classic stuff

 

[WrQth]

This is complete BS: I am like you: NO Facebook, no Twitter, no what´s up or whatsoever.
I just use my iPhone as a phone, with a contact list, take some photos and have alitttle bit of music on it. some simple apps like Sonos and deezer, that´s it.

AND I DISABLED nearly EVERYTHING, especially Siri and no also voice control. BUT I can prove that even with disabled voice control you can at least call someone and - if you have enough time test any name with voice control to control if this name exists in the contact list and you can call them "in the name of the owner"…

I´d call that a BIG SECURITY and PRIVACY ISSUE!!!

I could prove that anybody can access your iPhone - this is NOT PARANOIA, this is REALITY, my friend.

Just press the home button - and you are free to use anyone´s phone…

This is a shame AGAIN for apple.

Solution: Leave Siri on but don't use it, disable "Hey Siri" and don't allow Siri to be accessed from the lock screen.

 

[tigertazz]

Just because Apple has done yearly updates doesn't mean they have to keep doing them.

What I'm suggesting will increase the quality/security/reliability of iOS, not decrease it.

I don't expect bug-proof. I expect better than this, and I'm sure you can agree with that.

What you're suggesting will stagnate the OS in a world where stagnation is a loss of customer base. Look at Symbian look at Nokia. They saw no threat from all the features of new "smart phones" and very quickly consumers shifted their money to apple and the androids.

They cannot stop production on new features completely and having the entire iOS dev team search the code is a wage of resource. I'm sure that the graphic designer is going to be a great help....

What a ridiculous statement

 

[AppleScruff1]

I haven't read the thread yet, but let me guess, it's the users fault?

 

[djcerla]

Zero? Are you serious?

Yes, probably zero people will have data stolen this way. Apple will fix this quickly and also this applies to a tiny number of devices. Not only, but it won't happen under default settings.

 

[guerro]

Weird release this 9.3, we get stories ranging from being the most stable release, to people not being able to log into iCloud, security leaks etc.....seems like a bit of a dogs breakfast.

I'd be happy for apple to take more time with software releases and not give us annual updates to to iOS / OS X.

 

[kyliewylie]

I could start Siri from the securized screen and it even started immediately to ring someone from my contacts (the which I did not call up since two years) after I just said "hey siri" !!!

WTF is that ?????

I am getting VERY angry now…. security and privacy = ZERO...

Take a DEEEEEP breath my friend. Sometimes toggle switches in ANY version of ANY OS can show the incorrect setting. There is a difference sometimes between what is shown and why the actual value of the setting is. It happens in programming. It is caused by the computer/phone interaction with settings files that may cause the two to disagree. Ask any developer and they will tell you that it will pretty much ALWAYS be an issue. It just sounds like you could benefit from a software reset and a restore from iCloud. Fixes these issues 99% of the time.

In the future, rather than getting angry, get curious. It will help you to solve more problems.

 

[djcerla]

This is complete BS: I am like you: NO Facebook, no Twitter, no what´s up or whatsoever.
I just use my iPhone as a phone, with a contact list, take some photos and have alitttle bit of music on it. some simple apps like Sonos and deezer, that´s it.

AND I DISABLED nearly EVERYTHING, especially Siri and no also voice control. BUT I can prove that even with disabled voice control you can at least call someone and - if you have enough time test any name with voice control to control if this name exists in the contact list and you can call them "in the name of the owner"…

I´d call that a BIG SECURITY and PRIVACY ISSUE!!!

I could prove that anybody can access your iPhone - this is NOT PARANOIA, this is REALITY, my friend.

Just press the home button - and you are free to use anyone´s phone…

This is a shame AGAIN for apple.

You're simply wrong, learn how to use your stuff.

 

[IPPlanMan]

What you're suggesting will stagnate the OS in a world where stagnation is a loss of customer base. Look at Symbian look at Nokia. They saw no threat from all the features of new "smart phones" and very quickly consumers shifted their money to apple and the androids.

They cannot stop production on new features completely and having the entire iOS dev team search the code is a wage of resource. I'm sure that the graphic designer is going to be a great help....

What a ridiculous statement

No it won't stagnate. Reliability and Security are features, and doing this will improve the quality of Apple's product.

Yes, the graphic designer can help. They're being paid to. Or perhaps they can take vacation until the rest of the team is done.

 

[kyliewylie]

every other town / region has its own words in Germany. people can tell when i use Siri cuz no one would actually talk / write among friends like that as in "proper german" lol OR siri simply doesnt understand what i am trying to say. I cant use it for music either cuz it never gets english words / artists right when i tell it to play english songs while being set to german

It is no different for english. Being from the midwest, we have MANY ways in which we shorten words or have standings for entire phrases much like the German (or any other country for that matter) people have shortcuts rather than speaking proper grammar or syntax. Voice recognition AI is just not smart enough yet to handle phrases and words that break the collegiate rules of the language. You have to meet the AI half way and give it sentences it knows. As far as formal names for cities and businesses, it is no better in english. How could Siri possibly know the difference between when I want to search for "City Bank" or "Citi Bank". Computers lack contextual awareness. You're just going to have to baby it a bit until Apple has a chance to add every single business name and city name into Siri's word list. Do you see the reason why support for this is a little lackluster? There are entire languages that Siri does not speak that Apple wants to bring to market first.

My point is that its not certain languages that are being picked on. Every language has its limitations and we are all in the same boat.

 

[legacyb4]

iPhone 6s
- iOS 9.3.1, 3D touch enabled
- Touch ID enabled, 6-digit password, Voice Dial enabled, Allow Access When Locked: Today, Notifications, Siri, Reply, Wallet
- Siri on, "Hey Siri" enabled
- Privacy: Access to Twitter by Siri enabled
- Privacy: Photos (Twitter)
- Twitter (installed and enabled in Settings)

"Hey Siri, search Twitter" results in "You'll need to unlock your iPhone first"

 

[kyliewylie]

iPhone 6s
- 9.3.1
- Touch ID enabled, 6-digit password, Voice Dial enabled, Allow Access When Locked: Today, Notifications, Siri, Reply, Wallet
- Siri on, "Hey Siri" enabled
- Privacy: Photos (Twitter)
- Twitter (installed and enabled in Settings)

"Hey Siri, search Twitter" results in "You'll need to unlock your iPhone first"

The original "vulnerability" may have been caused by the tester accidentally unlocking his iPhone with touchID or not waiting the compulsory time period to allow the "Require passcode" setting to time out.

 

[wigby]

Who uses Siri anyway? I've disabled it since it doesn't offer much to German speaking people like me.

You've just answered your own question - non-German speaking people use Siri.

 

[djcerla]

The web is exploding as MrAverigeUser discovered a devastating iOS flaw!

said no one, ever.

 

[bushido]

I still miss that place. Can Siri get you a Curry wurst mit pommes und einen Fanta?

there you go. chinese tho? i dont think thats very authentic