Ways to bypass the iOS lock screen using Siri

A new way to bypass the iOS lock screen with Siri

A fresh way to bypass the lock screen proves once again the rightness of experts recommending disabling the use of Siri with the active lock screen in order to avoid various problems. The problem was discovered by the bloggers EverythingApplePro and iDeviceHelps. Bug is present on the iPhone and iPad, running on iOS 8 and newer , including the latest iOS 10 . To successfully implement the attack, as usual, you will need physical access to the phone, and the active active Siri when the lock screen is on.

First, the attacker needs to find out the phone number of the victim, and for this just needs an assistant Siri: he needs to ask the question " who am I? "( Who am I? ). Then, knowing the number of the victim, the attacker should call her or initiate the call through FaceTime. It does not matter how the smartphone is blocked, with a password or with the help of the Touch ID, when the call comes, there will be an opportunity to answer it. At this point, the attacker needs to click on the "Messages" icon and select a custom message, supposedly in order to respond via SMS. Although the screen lock is still active, a window will appear for typing a new message.

Now the attacker will need Siri's help again. You need to tell the assistant to activate the VoiceOver function. This is a gesture-controlled voice interface function, without activation of which the attack will not work.

Returning to the screen of the message set, the attacker will need to show a little "sleight of hand". You have to double-click on the field for entering the name of the recipient of the message, at the same time pressing any symbol on the keyboard. This can take several attempts, but if everything went well, the attacker will be able to type in the "To" field something arbitrary, although initially the message should have been intended specifically for the person who just called the device.

Since the attacker has "unblocked" access to the "To" field, the entire address book of the victim is accessible to him. At this stage, you can disable VoiceOver, as it is no longer needed and is pretty annoying.

In the victim contact list, you need to find an entry with the "i" icon, click on it, and then go to create a new contact.

In addition to accessing all contacts and a photo of the victim, the attacker can also select any contact from the list and see all the dialogs that the device owner previously had with this user.

Demonstration of the attack performed by themselves EverythingApplePro and iDeviceHelps:

How to bypass the lock screen on the iPhone 6S and 6S Plus

The lock screen on the iPhone 6S and 6S Plus can be bypassed, even if they are running the latest iOS 9.3.1. Protection can be deceived with the help of Siri, which will allow the attacker to get access to the list of contacts and photos of the victim.

Now Rodriguez discovered that bypassing the lock is still relevant and can be implemented on the iPhone 6S and 6S Plus with 3D Touch support. The problem applies to all devices running on iOS 9.2 and higher, including iOS 9.3.1, which was released last week. The researcher published a proof-of-concept video, which can be seen below. The action scheme for exploiting the bug has changed a little, here's what you need to do to trick the iOS protection:

Lock the device.

Call Siri and say "Search Twitter".

Siri asks what to look for, you need to answer "at-sign Gmail dot com" ("@ gmail.com") or name any other popular email domain. The idea is that you need to find tweets containing email addresses.

Having received the results, click on any tweet with the mail address.

Now we use 3D Touch on the email address to call the context menu.

Select "Create New Contact".

Now you can add an image, that is, view all the images stored on the device.

If you use the "Add to Existing Contact" option, you can also view the entire list of victim contacts.

Video demonstration:

The researcher recalls that until the bug is fixed, which means that anyone who has physical access to the smartphone can access personal data.

iOS 9 allows you to access photos and contacts without entering a password

In iOS 9, a vulnerability has been discovered that, with physical access to the device, allows you to bypass the protection of the operating system and literally within 30 seconds to gain access to other people's contacts and photos.

Any device running iOS 9 is vulnerable to this bug (iPhone, iPad or iPod touch), even a protected Touch ID. Bypassing the device's password for an intruder will help ... personal assistant Siri.

"Wake up" the device and type the password incorrectly 4 times.

During the fifth attempt to enter a password, enter 3 or 5 characters (depending on how long the password is). Instead of entering the last character, press and hold the "Home" button to call Siri. At the same time, enter the last character of the password.

If everything is done correctly, Siri will appear. Ask the assistant, what time is it.

Click on the Clock icon to open the Clock application and select the addition of a new clock (new Clock). In the Choose a City field, type any random rubbish.

Double-click on the typed word to bring up the copy & paste menu, "Select All", and then click on "Share".

In the Sharing options, click on the "Message" and again type on the keyboard something, then click "Return" and twice on the contact name on the top.

Select Create New Contact, click Add Photo, and then Choose Photo.

Now you can see the entire image library of the device, which, among other things, is still locked with a password.

The video demonstrates the described method in action:

While Apple has not fixed this bug, but you can protect yourself. To protect yourself from hacking, users are once again advised to turn off the Siri assistant if the phone is locked . You can do this in Settings> Settings> Touch ID & Passcode . There is no official fix for the vulnerability yet.