Lock Screen Bypass in iOS 7 Beta 1
A new version of iOS, a new lockscreen/passcode bypass! Luckily this one was caught early in the first Beta of iOS 7 released to developers at WWDC 2013. Although this lockscreen bypass is simpler than some of the previous ones that required some tricky steps to pull off, it’s probably worth pointing out that it will only allow access to the phone’s photos, and the ability to delete, email, tweet or upload the stored image files. It does not allow access to any other apps.
I should point out that I played with iOS 7 for a day, and it was so buggy that I had to downgrade back to iOS 6. Luckily Apple has plenty of time to fix all these issues come the release date this fall.
To bypass the lockscreen simply follow these easy steps:
- Pull up the Control Center
- Tap the Calculator icon to open it
- Pull up the Control Center again
- Tap the Camera icon to open it
- Tap the photos icon in the bottom-left corner to get full access to the photos
Check out the video below to see it in action.
iPhone and iPad Activation Lock Coming in iOS 7
Those of you who have been diligent in securing your iOS devices with passcodes, wiping and Find My iPhone, just to have a thief restore your device and keep on going – well – your prayers have been answered. Coming in iOS 7 is a great feature called ‘Activation Lock’.
With Activation Lock enabled, even if your iPhone or iPad is restored to its factory settings, the user will need to activate the device using the Apple ID of the previous user. Also, if the device was put into Lost Mode in Find My iPhone, the lock screen will continue to display the fact that it is lost until the device is activated.
This is a hugely useful feature that, if used properly, will make iPhones and iPads a significantly less attractive target to thieves, as the stolen devices would be rendered useless to them. It was nice to see Apple address one of the main concerns that users have been expressing about the bypass-ability of Find My iPhone. Check out Protecting and Recovering Your iPhone and iPad from Loss and Theft (will be updated soon with this new feature).
New Lockscreen Bypass in iOS 6.1
In a vulnerability that’s quite similar to one in iOS 4.1 a couple years ago, another lockscreen bypass has been discovered in iOS 6.1 which allows someone with physical access to your iPhone to make calls, view and modify your contacts, send an email to your contacts, listen to your voicemail, and access your photos (by attempting to add one of these to a contact).
The method for this bypass is fairly simple (see the video below for it in action):
- Swipe to unlock and then tap Emergency Call
- Make an emergency call (eg. 112/911) and immediately cancel it (please don’t unnecessarily call the emergency services ;)
- Press the power button twice
- Slide to unlock
- Hold down the power button for a couple seconds and then tap Emergency Call again.
- …
- Profit!
I should point out that this doesn’t seem to work on my iPhone 4 for some reason. Something does happen, but I just get a black screen until I press something whereupon I’m booted back to the lock screen.
Jailbreak for iPhones, iPads and iPods Running iOS 6/6.1 Now Available (evad3rs)
Seems like this one has been a long time in the making, but there is finally a jailbreak for any iPhone, iPad or iPod running iOS 6 or 6.1. This jailbreak comes courtesy of a group called evad3rs. The jailbreak can be performed using any computer running Mac OS X, Window or Linux, and is a full un-tethered jailbreak meaning that once jailbroken the device can be rebooted without it needing to be re-jailbroken.
To perform the jailbreak, simply download the software for your OS, plug in your device, launch the evasi0n app and click Jailbreak. It’s pretty much as simple as that! Cult of Mac has a good summary of this process.
Quick warning: I know that many people are eager to jailbreak their devices – sometimes I also get annoyed at the restrictions Apple places on their devices – but remember that when you jailbreak you’re not only running exploit code and trusting a third party not to do anything malicious, but you also make your device less secure in the process!
With that in mind, check out the latest jailbreak at evasi0n.com.
New “Lost Mode” in Find My iPhone (iCloud)
With iOS 6, Apple will be releasing an updated set of web apps on iCloud.com, including Mail, Calendar, Notes, Reminders and Find My iPhone. Find My iPhone is a useful feature that allows you to track or wipe your iPhone, iPad or iPod Touch should it get lost or stolen. For more info check out my article on Protecting and Recovering Your iPhone and iPad from Loss and Theft. In this post I just want to point out the changes to Find My iPhone, in particular the new “Lost Mode”. Read more
There Is No Camera Lock Screen Bypass in iOS 5.1
There have been reports (and here) of iOS 5.1 containing a camera bypass tied to the new camera shortcut on the lock screen. The people who have reported this are sadly confused about the security timeout enforced by iOS’s Require Passcode setting (Settings > General > Passcode Lock > Require Passcode). If your Require Passcode setting is set to anything other than Immediately, then your device (and the camera roll from the camera shortcut) will be accessible for the entire duration of time specified (ie. 1 minute or 5 minutes).
As always, the best setting for Require Passcode is Immediately. That way you know that when you lock your device, it is actually locked, and will prevent someone from gaining access to it without the passcode within the minutes following the ‘lock’.
Sadly people seem all too eager to rush and report on iOS vulns before actually verifying them.
TDLR; There is no lock screen bypass in iOS 5.1 using the new camera shortcut. They were wrong.
Frequently Asked Questions About Find My iPhone (and iPad)
I’ve been getting a lot of hits for my article on Protecting and Recovering Your iPhone and iPad from Loss and Theft, and the search queries I’m seeing in my logs, together with the visitor comments, have raised a number of recurring questions. I’ve decided to publish this one-stop-shop of answers for all of the different queries that I see people searching for when they arrive. Although my article addresses a number of these, I wanted to put them all in one post for easy reference. I’ll update this post as new questions crop up. Here goes, in no particular order:
New! iPhone Lockscreen Generator
When people ask me about the different ways they can protect their iPhone in case it gets lost or stolen, I usually point them in the direction of my article on Protecting and Recovering Your iPhone and iPad from Loss and Theft. I just updated that article to include a tip about creating a custom lockscreen image for your iPhone that may help someone return it to you in the event it gets lost.
A tip is all good and well, but creating such a customised image may be beyond the technical abilities of your average iPhone user, so I hacked together the brand new iPhone Lockscreen Generator!
http://lockscreengenerator.com
This free online tool allows anyone to create a customised lockscreen (currently with one of four background images), in less than a minute. Just enter your contact details (first name, alternate contact number), and maybe a short note for whomever finds your iPhone (reward maybe?), click generate, then tap/click on the image to download it. You can do this on your computer, and email yourself the image, or do it directly on your iPhone.
Once downloaded to your iPhone, you can set the image as your lockscreen wallpaper by going into the Photos app, tapping your image, then tap the ‘send to’ icon in the bottom left-hand corner of the screen, select Use as wallpaper > Set > Set Lock Screen.
Don’t forget to share this with your friends! You can even use one of the share links below ;) If you have any feedback or tips, let me know.
Charlie Miller Discovers iOS Code-Signing Bypass Vulnerability
Security researcher Charlie Miller (@0xcharlie) has discovered a significant flaw in iOS which may allow a malicious app on the App Store to download and execute arbitrary unsigned code. What this means for iPhone, iPad and iPod Touch users is that installing a malicious app may allow an attacker to obtain shell access to your device, and download contacts or images.
Apple reviews every app submitted to the App Store, which has meant that iOS users have not had to worry about outright malware. Since this vulnerability allows the apps to fetch code remotely, they can perform actions not reviewed by the App Store staff. Charlie had submitted a proof-of-concept app that was approved (see video below), but has since been removed by Apple.
The reason this vulnerability works is based around some changes Apple made in iOS 4.3 last year, which allowed Mobile Safari to run javascript at a more privileged level on the devices. This change required Apple to make an exception for Safari to execute unsigned code in a particular area of memory. Charlie Miller’s bug is allegedly a very unique case that allows any app to take advantage of this, and hence run their own unsigned code.
Charlie will be presenting the vulnerability in detail at the SysCan conference in Taiwan next week. Apple has already released a developer beta of iOS 5.0.1 which patches the recent iPad Smart Cover lock screen bypass, but I would not be at all surprised if they release another beta which includes a fix for this bug. Until then, be careful to only install apps from developers you trust.
[Update] Apple has kicked Charlie out of the Developer program. At first I felt that this was an extremely bad reaction on Apple’s part. That said, Apple is probably most upset that Charlie’s proof-of-concept app could have been installed by legitimate users. Regardless of Charlie’s intentions, this could constitute malware, and he should have removed the app as soon as he saw the flaw existed. The posting of his video above probably didn’t help matters either.
iPad Lock Screen Bypass Vulnerability using Smart Cover [Patched]
Marc Gurman at 9to5Mac has discovered a vulnerability on the iPad that allows for a limited bypass of the device’s lockscreen. Anyone with an iPad Smart Cover (or fridge magnet) can gain access to the previously-open app (or the home screen if no app was open).
By holding the power button to bring up the ‘Power Off’ screen, closing the smart cover, re-opening it (or just sliding a fridge magnet along the right-hand side of the device), and clicking cancel, the attacker will be dropped into the screen that was open before the iPad was locked. If the attacker gets dropped into the home screen, then they’ll be able to see the installed apps, but won’t be able to open anything. If Safari or Mail (or any other app) was the open when the device was locked, then the attacker would have access to that app.
Unlike Siri being available from the lock screen, which is not a security flaw (an unintended behaviour), this one actually is; and although an attacker does not get full control of the iPad, the severity depends on whether a sensitive app was being used before the device was locked.
Luckily it is possible to protect yourself against this bug in the interim by disabling Smart Covers in Settings > General > iPad Cover Lock/Unlock > Off. Expect Apple to patch this in iOS 5.0.1. Check out 9to5’s video below for a demonstration:
[Update] Apple did indeed patch this bug in iOS 5.0.1. Those of you who disabled your Smart Covers for security purposes can now re-enable them!
Loading ...
