Slashdot Mirror

← Back to Stories (view on slashdot.org)

iOS 7 Lock Screen Bug Leaves Certain Apps Vulnerable For Access

Posted by Soulskill on from the at-least-it's-a-flat-bug dept.

MojoKid writes "News of a proven security vulnerability involving Apple iOS 7 has started making the rounds. The exploit specifically involves the lockscreen, the most common piece of security that stops an unauthorized individual from gaining access to anything important on your phone. The 'hack,' if you want to call it that, is simple: Swipe up on the lock screen to enter the control center, and then open the alarm clock. From there, hold the phone's sleep button to bring up a prompt that will ask you if you wish to shut down, but instead of doing that, hit the cancel option, and then tap the home button to access the phone's multi-tasking screen. With access to this multi-tasking screen, anyone could try opening up what you've already had open on your phone. If you had Twitter open, for example, this person might be able to pick up where you left off and post on your behalf. Or, they could access the camera — and of course, every single photo stored on the phone." The new iPhone models were released today; iFixit has a teardown of the iPhone 5s, giving it a repairability score of 6/10.

12 of 135 comments (clear)

  1. With the NSA storing your every move by Mister+Liberty · · Score: 3, Insightful

    this is the least of your worries.

    1. Re:With the NSA storing your every move by Sockatume · · Score: 4, Insightful

      You know, because that applies to every security story and adds no specific value to any of them, you just have to say it once and then stop.

      --
      No kidding!!! What do you say at this point?
    2. Re:With the NSA storing your every move by MightyYar · · Score: 3

      It is annoying. This overreach is even one of my pet causes, but this spam makes people who think it is dangerous look bad.

      --
      W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
    3. Re:With the NSA storing your every move by Sockatume · · Score: 4, Insightful

      My chief complaint is that it's an either-or proposition which makes it seem like we should just disregard all other security failures just because we're operating under a single massive one.

      --
      No kidding!!! What do you say at this point?
  2. Reminds me of this Windows gif by mystikkman · · Score: 5, Funny

    Windows login gif.

    http://i.imgur.com/fqjnK.gif

  3. Can't replicate by jamie · · Score: 4, Informative

    I can't replicate it either. The YouTube video claims I double-tap the home button but the second tap is slightly longer? By the end of the first tap it's already bringing me back to the lock screen, i.e. by the time I'm pressing down for the second tap, I'm already being taken back to the lock screen. iPhone 5, updated last night to 7.0 (11A465).

  4. iFixit by Sockatume · · Score: 4, Funny

    From iFixit's teardown:

    We are currently involved in heavy lobbying to our product designers to create 14k gold replacement screws. They'll be $50 each and strip the first time you try to unscrew them, so they will be perfect for the iPhone. Stay posted.

    Ha ha ha.

    --
    No kidding!!! What do you say at this point?
  5. Re:Easily avoided by Culture20 · · Score: 3, Interesting

    There are plenty of people who want an instant camera instead of fumbling with passcodes and opening the camera app for 30 seconds.

  6. Re:Easily avoided by joh · · Score: 4, Informative

    As soon as I did the iOS7 update, I noticed that you could access the camera from the lock screen, and I didn't want someone taking inappropriate pictures on my iPad if they stole it.

    You could access the camera from the lock screen from iOS 5 on.

  7. Different thing altogether... by Thruen · · Score: 3, Informative

    Couple quick things. Firstly, that feature was already there, odds are you had disabled it before and that setting was reset with the update. Also, you can't access any existing photos from there, it'll only let you browse the photos you've taken since opening the camera, and resets each time you lock the screen again. There are similar features on other phones, it's handy and not by itself a security risk. As for not imagining anyone wanting to have the device open for the camera when it's locked, I think you lack imagination, and possibly even basic sense. I take advantage of it most frequently when I'm traveling and wish to quickly snap a photo without having to type in my password, it often makes the difference between a photo of an animal grazing and one of their behind as they run into the woods.

    It's worth noting that this feature doesn't seem related in the least to the security flaw discussed here, as the camera is meant to be quickly accessible in this way. This means the suggestion of turning off control panel access won't fix the security flaw, if that's what you had in mind.

  8. Comment removed by account_deleted · · Score: 3, Interesting

    Comment removed based on user account deletion

  9. Re:Could not replicate (as many others can't) by denmarkw00t · · Score: 3, Informative

    I tried a good 10 times on my 4 before I got it to work - it's not mentioned and an easy bit to miss in the video: as soon as you tap close you have to do the double-tap on the home button and hold the second tap a little longer than a second maybe. The key though is to do this AS SOON as you hit "Cancel." How this person ever came across the flaw is beyond me, but good poking. Someone should hire her for a QA team.