Slashdot Mirror

← Back to Stories (view on slashdot.org)

Locked iPhones Can Be Unlocked Without Password

Posted by timothy on from the now-lookie-hyeah dept.

snydeq writes "Private information stored in Apple's iPhone and protected by a lock code can be accessed by anyone with just a few button presses. Pressing the emergency call button at the unlock screen, followed by two taps on the home button, takes you to the iPhone's private 'favorites' page without the need to enter the unlock code, MacRumors user greenmymac has found. If the owner of the phone has favorite entries in their address book containing URLs, e-mail addresses or mobile phone numbers, then those entries can be used to launch the browser, mail application or SMS software, and gain access to private Web favorites, e-mail messages, and text messages stored in the phone, again without entering the unlock code."

16 of 102 comments (clear)

  1. CALL OUT THE DOGS by The+End+Of+Days · · Score: 4, Funny

    Quick, to the Apple-bashing-mobile

    1. Re:CALL OUT THE DOGS by Anonymous Coward · · Score: 4, Funny

      It's just down from the Microsoft-bashing mobile and next to the Comcast-bashing mobile. They all look similar, so make sure you have the right keys, oh and replace the memes if you use them all. Gotta keep a fresh supply.

    2. Re:CALL OUT THE DOGS by BasharTeg · · Score: 4, Funny

      There's no need to fear! Apple Apologist Squad to the rescue!

      Quick, spin that security vulnerability into a feature! Now, follow up by making excuses for ridiculously overpriced hardware! Finish them off by implying that 6.5% PC market share growing to 7.2% PC market share is the new "Apple Revolution"!

      We've done it! Truths about the downsides to Apple products have been dismissed and discredited, and the comfort provided by our elitism can continue for years to come. Well done Apple Apologist Squad!

    3. Re:CALL OUT THE DOGS by ByOhTek · · Score: 4, Insightful

      And the apologist proudly demonstrating he's no different.

      --
      Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
  2. Not quite... by daybot · · Score: 4, Informative

    Pressing the emergency call button at the unlock screen, followed by two taps on the home button, takes you to the iPhone's private 'favorites' page without the need to enter the unlock code

    Not quite - it takes you to Favorites or iPod depending on your double-tap shortcut setting. If it's set to the home screen then you are just prompted for the passcode. See here

    1. Re:Not quite... by Charles+Dodgeson · · Score: 4, Informative

      I do see the behavior described: Emergency call, then double press takes me to my phone "Favorites". From the favorites, I can look up the details of of those address book entries and bring up Safari or Mail.

      From Safari opened this way, I can get to my bookmarks. And I suspect that from Mail (haven't tested it yet), I could get to all of my contacts. All of this with completely by-passing the PIN.

      --
      Prime numbers are exactly what Alan Greenspan says they are -S. Minsky
  3. Just tested... by Elindor · · Score: 5, Informative

    There's a way to prevent this - set the Home Button to go to Home when double clicked - this simply drops it back to the PIN request (Or, if it's in iPod mode, bring up the basic iPod controls)

  4. The easier and more complete way by Brilthor · · Score: 4, Informative

    Actually all you need to do is call the iphone, then when the call ends you are back at the home screen unrestricted. On a slightly unrelated note most security articles seem to point out the obvious flaws instead of the clever ones (clearly the iphone lock function is only a slight deterrent)

    1. Re:The easier and more complete way by Teese · · Score: 5, Insightful

      Actually all you need to do is call the iphone, then when the call ends you are back at the home screen unrestricted. On a slightly unrelated note most security articles seem to point out the obvious flaws instead of the clever ones (clearly the iphone lock function is only a slight deterrent)

      That's interesting.

      typical behavior when you realize you've lost your phone: Call it, and see if you can hear the ring.

      Now when that happens, the person who stole it can answer and say "thanks for unlocking your phone!"

      --
      "I'm a Genius!"*


      *Not an actual Genius
    2. Re:The easier and more complete way by shitzu · · Score: 5, Informative

      Actually all you need to do is call the iphone, then when the call ends you are back at the home screen unrestricted.

      No it does not. It still asks for the code after the call has ended.

  5. Re:Back door anyone? by gEvil+(beta) · · Score: 4, Insightful

    This is nothing more than a nice backdoor left in there by apple so that they have constant access to your phone.

    Yes, because when Apple wants to access my iPhone, they're going to come to my house, pick up the phone, and start pushing buttons....

    --
    This guy's the limit!
  6. Re:Back door anyone? by Farmer+Tim · · Score: 4, Funny

    Doesn't sound impossible to me, considering how many /.er's buttons Apple manages to push remotely.

    --
    Blank until /. makes another boneheaded UI decision.
  7. Re:This just in by RiotingPacifist · · Score: 4, Insightful

    funny because thats not the case in normal phones. 3 pins wrong and your out, sure you might be able to get round it if you were a gang of phone thieves but with the iphone anybody can get round it and they dont even need your phone for that long

    --
    IranAir Flight 655 never forget!
  8. Re:not really surprising by alvinrod · · Score: 4, Insightful

    If I had mod points I probably would have modded it 'Troll' as well. Not because I somehow love Apple products or own an iPhone and feel that need to justify my purchase but because the language in the post makes it seem as though the iPhone is only a kid's toy. Swap iPhone and Blackberry around and it's still a Troll, but he's just trolling a different audience. He could have made the exact same point by changing his wording and suggesting that this is a reason why he would not recommend using the iPhone in a business setting. Same message, but the language isn't anywhere near as inflammatory.

    Can I assume whoever modded the comment 'insightful' has something against Apple and decided to take a shot at them rather than modding unbiased?

  9. Re:not really surprising by Coraon · · Score: 4, Funny

    My guess too. Mac zealots are a strange tribe, if you tell them apple cant do something they get really bent out of shape. And just because I feel like burning more Karma listen up Mac fan boys: Steve Jobs cannot walk on water, he's just a mortal man.

    --
    -Ours is the wisdom of Solomon, the magic of Merlyn, the fall of Icaris.
  10. This is a classic sandbox bug. by argent · · Score: 4, Insightful

    I've run into all kinds of "kiosk" applications on every platform where this kind of bug exists, from bulletin board systems using applications with shell escapes in the '70s and '80s through "telnet:" URLs in restricted freenix front ends to embedded browsers on dektop operating systems. You can also use similar tricks to get past Apple's kiosk attract mode on Macs in computer stores, an I've run into them in a number of PC vendor demo modes over the years.

    When you build a sandbox you have to build it from the inside out. Never introduce anything to the sandbox unless you are absolutely certain that it doesn't have a backdoor. Not "unless you are certain you can close the backdoors"... sandbox programs have to be built around a model that "fails closed"... any action that increases privileges must require an explicit action from outside the program (such as installing a plugin). The amount of effort to build a sandbox out of components that default to an open mode and need to be "locked down" is so much greater that it's easier to reinvent the wheel than patch up the wrong kind of wheel to fit.