Flaw in iOS 6.1 lets you bypass password-protected lock screen

[Jos]

A security flaw recently discovered in iOS 6.1 lets anyone bypass your iPhone password lock and access some of your data after following a series of steps. The method is detailed in the YouTube video below and involves making and immediately canceling an emergency call, holding down the power button a couple of times during the process, and pushing the home button after getting into the phone’s contact list.

Once the lock is bypassed you won’t actually have full access to every app on the phone but it’s still possible to snoop around local device data. Particularly, users will be limited to the Phone app, and from there it’s possible to browse contact information, make calls, check voicemails, and look through photos (by attempting to add a photo to a contact). You can even send emails and texts through the sharing-a-contact feature.

Exactly how someone came up with such a combination of button holding and tapping is beyond me, but I was able to verify the method on an iPhone 4 running iOS 6.1 and it works. No word on whether iPads and iPods are vulnerable too but it seems unlikely since the process involves making an emergency call.

This isn't the first time a lock screen vulnerability in iOS has become public. A very similar bug affected iOS 4.1 back in 2010 and was fixed in iOS 4.2. The company hasn’t commented on the latest loophole yet.

Here are the detailed steps:

1. Lock device.
2. Slide to unlock.
3. Tap emergency call and type in your emergency number (911, 112, ...).
4. Tap the call button and immediately cancel the call.
5. Lock device again with the sleep button and then turn it on using the home button.
6. Slide to unlock.
7. While on the lock screen hold the sleep button for three seconds and quickly tap emergency call before the switch off slider shows up. This will cause your phone’s screen to flicker and then show the phone app.

Update: Apple has issued a statement saying it plans to fix the exploit in a future software update. The company did not offer a timeline of when such an update would arrive.

Permalink to story.

https://www.techspot.com/news/51641-flaw-in-ios-61-lets-you-bypass-password-protected-lock-screen.html

 

[captainawesome]

Yeah how did he come up with that? He was practicing his Mortal Combat combo's!

 

[Guest]

Did they just move the same team responsible for Apple Maps out and over to the iOS side of the house? I can't believe how problematic updates have become. Apple has not even acknowledged they broke ActiveSync integration in this last release. C'mon, you guys can't afford to screw-up with so many other vendors at your heals.

 

[Skidmarksdeluxe]

Yeah how did he come up with that? He was practicing his Mortal Combat combo's!

Nah. Being an iPhone he was probably just trying to switch it off.

 

[Guest]

Heh, I keep hearing of iphones being accessed easily and "bad" programming all around... And companies want to replace more secure phones with this?

 

[Divvet]

Awesome, just tried this on my friends iPhone, hilarious.

 

[misor]

Noooo!, you are tapping it wrong...

"Exactly how someone came up with such a combination of button holding and tapping is beyond me, but I was able to verify the method on an iPhone 4 running iOS 6.1 and it works."
LOL.

when would my favorite "up, up, down, down, left, right, left, right, A, B, A, B, shift, start" make a comeback?

 

[tonylukac]

This reminds me of the payphone days when they were first putting in ess (electonic switching system). If you placed a toll call (one that costs more than 10 cents), an operator would come on asking for more money. If you depressed the switchhook for about 2 seconds and released, the operator would go away and the call would go thru. All money was returned and the call was absolutely free. There was another bug in the later version of ess (ess 5) where you could place a call from the payphone and talk for less than 3 minutes, even long distance. When done, you pressed the switchhook and the operator would come on. You'd tell her you were done with the call, hang up, and the money would return like you were at a slot machine. What did att do about it when they found out? Instead of hiring some technicians they banned long distance dialing from all payphones and then got rid of payphones entirely.


There was a trick at verizon (formerly gte) payphones. If you were placing a 10 cent call, some primative systems allowed you to dial the call and then deposit the money if the party answered, in case the line was busy. You could just talk thru the earpiece and never deposit 10 cents.

 

[SNGX1275]

This doesn't work if the user has turned off the "simple passcode" option.

 

[spydercanopus]

These "flaws" are purposefully integrated to help law enforcement.

 

[hahahanoobs]

This reminds me of the payphone days when they were first putting in ess (electonic switching system). If you placed a toll call (one that costs more than 10 cents), an operator would come on asking for more money. If you depressed the switchhook for about 2 seconds and released, the operator would go away and the call would go thru. All money was returned and the call was absolutely free.

Good one. I remember 10 or so years ago I could send text msgs for free by putting a "+" sign, followed by the number (ie: +14162345656) to send local text messages. It worked for quite a while before Fido patched it.

 

[Jad Chaar]

This is very similar to that flaw in ios 5.x.x for the iPad that allowed someone to go to the lock screen, go to the shutdown screen, close the smart cover and get access to the device. Interesting how something similar exists once again.

 

[captaincranky]

I'm still reasonably sure if you can just get by the lock screen, you're holding it wrong....

 

[adamsmith0123]

Based on the news apple will release the 6.2 update soon to fix this problem.