Site icon Sophos News

iPhone lockscreen bypass: iOS 13 tricked into showing your contacts

Mr. Lockscreen Bypass has done it again.

Spanish security sleuth José Rodríguez on Friday posted a YouTube video of his most recent iOS lock-screen bypass: one that allows an iPhone to be tricked into showing its address book without the need to unlock the screen.

The researcher told The Register that he found this bypass in July, in what was then the beta of iOS 13.

As the video shows, the bypass involves receiving a call and opting to respond with a text message, and then changing the “to” field of the message, which you can do via voice-over. The “to” field pulls up the phone’s contacts list, thus enabling randoms to paw through your contact list without needing to first unlock your phone.

This isn’t a terribly serious bug. To exploit it, snoops have to get their hands on a victim’s device, and then they need to call it from another phone.

It’s also reportedly pretty easy to prevent: as a reader tweeted after The Register posted its story, you just need to go to Face ID & Passcode settings > Allow access when locked and toggle off the Reply with Message option. That feature is reportedly enabled by default in iOS 13.

Plus, the lockscreen workaround was found in a beta, which doesn’t really count as much as would a bug in a live product. That’s apparently why Apple reportedly reneged on its initial promise to pay Rodríguez the “gift” that he asked for.

According to the researcher, he wanted a $1 Apple Store card. He told the Register that he wanted it as a trophy. First Apple said yes, Rodríguez said, then it said no:

I contacted Apple asking for a gift in thanks for reporting a passcode bypass, Apple agreed to give me a gift.

I reported the security problem and then Apple retracted, apologized and told me that it was not allowed to thank by giving gifts for security reports during beta period.

OK… rules are rules… but… really? We’re talking about a serial lockscreen hacker, here. Doesn’t he deserve a little something?

Even if his latest isn’t terribly concerning from a security standpoint, his track record is kind of amazing. Here’s the timeline I put together of his successful exploits leading up to this one. If you know of others, let me know:

The Register reports that as of Friday, Apple hadn’t addressed the latest vulnerability.

Granted, if you decide to make only some things available when an iPhone is locked, rather than enforcing a strict boundary, then problems like this are probably quite hard to stop. It certainly looks that way, when you eyeball the long list of bypasses Rodríguez has come up with, some within mere weeks of when Apple has tackled whatever bypass he came up with before the update.

But after all, under normal circumstances, everything on your phone is linked together for usability and convenience (phone, SMS, contacts, etc.), and movement between apps is supposed to be slick and easy.

Still and all, at this point, you wonder why Apple doesn’t just give Rodríguez the damn phone as part of their standard testing procedure.

C’mon Apple, just give him the phone! and the $1 coupon – framed so he can hang it on his wall!

Exit mobile version