iOS 7 Flaw Lets Anyone Use Locked iPhone

By Paul Wagenseil
published

A weakness in iOS 7, Apple's new mobile operating system, lets anyone make calls, send emails or post Facebook updates from a locked iPhone, researchers showed.

Apple's new mobile operating system, iOS 7, has a major security flaw that lets anyone hijack a locked iPhone to make calls, send text messages and emails and post updates on Twitter and Facebook.

This is possible because Siri, Apple's mobile personal-assistant software, is poorly configured, say two researchers from Campbell, Calif.-based security firm Cenzic.

"The weakness is directly within Siri and compromises iOS 7's ability to control common tasks that should be based on permissions," Tyler Rorabaugh, Cenzic's vice president of engineering, wrote in a company blog post.

Unauthorized users should not be able to do anything on locked mobile devices, except call 911.

Staffers in Tom's Guide's New York office were able to replicate Cenzic's findings, and used Siri to post Facebook status updates from locked iOS 7 phones.

MORE: 15 Best iOS 7 Apps

Cenzic posted a video on YouTube showing the researchers who discovered the flaw, Abhishek Rahirikar and Michael Yuen, posting status updates on Rorabaugh's Facebook page using his phone.

Some of the same flaws exist in iOS 6 as well, Rorabaugh wrote.

"By, default Siri is turned on even after the iPhone is locked," Rahirikar told Tom's Guide in an email. "It can still post on  things like Twitter [and] Facebook, [and] it can be used to view calling history.

"Access controls in Siri are not comprehensive," Rahirikar said. "You need to turn Off Siri completely, or turn off Siri when the phone is locked, using [an] iPhone setting. But by default it is turned on and vulnerable."

Cenzic recommended disabling Siri entirely until Apple patches the flaw.

Follow us @tomsguide, on Facebook and on Google+.

Paul Wagenseil
Paul Wagenseil

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.

20 Comments Comment from the forums
  • This makes me happy
    Reply
  • house70
    iOS is such an easy target, after one day the flaws start to surface. I guess the ones that can't have the fancy Siri (because Apple said so, not because their phones were not capable) are better off. The ones that can't even upgrade to iOS 7 are of course the winners.
    A bunch of people at work were helpless today (and kinda useless, too), because their iToys were giving them fits during/after the upgrade. Also, missing features everywhere, according to their respective hardware versions. Apple gives everybody the iOS 7 version in the 'about' section, but under the surface lurk all kinds of crippled versions. Fragmentation at it's finest concealment.
    Reply
  • wopr11
    Its not an iOS 7 Flaw - those users are not holding the phone right.
    Apple will send rubber bands to all those users to solve the problem.
    Reply
  • weierstrass
    I just tried it, Siri still asks of the password if you try more critical things, for example accessing photos. Still I would like it to also block more basic stuff like posting to Facebook.
    Reply
  • derekullo
    User: Siri, I would like to disable Siri.
    Siri: I'm sorry, Dave. I'm afraid I can't do that.
    User: O S**T
    Reply
  • wopr11
    Its not an iOS 7 Flaw - those users are not holding the phone right.
    Apple will send rubber bands to all those users to solve the problem.
    Reply
  • nolarrow
    1. Grab co-workers phone
    2. Post something negative about the boss on linkedin
    3. ........
    4. Profit?
    Reply
  • jimmysmitty
    11572882 said:
    Seeing the fanboys slam Apple is amusing since Android has more security holes than Swiss cheese.

    Actually Apples products are known to be very insecure. At PWN2OWN they are normally the first systems to be cracked, especially Safari.

    Android is better, but not by much TBH. What we need is a more Windows OS based phone to include AD style control. That would be nice.
    Reply
  • Azn Cracker
    windows phone ftw!!!!
    Reply
  • hotroderx
    I think its funny all the hate Apple products get on these forums. The way some people act you would seriously think there foaming at the mouth as they type there comments.

    One truly has to wonder how many of these people have given a Apple product a serious try?

    I also wonder how many of them buy into the hype that Google is some kind of saint company that does no wrong.

    The bottom line is all cell phone platforms have there pros and cons.

    As far as the company's them self's go, if you think Google isn't as dirty as Microsoft and Apple your only kidding your self. The thing is Google is better at hiding there dirty secrets then the competition.
    Reply