::Trend Micro Threat Resource Center::

30 October 2010

Enormous Security Flaw In IOS 4.1

This is one for the record books. The password on your iPhone is not nearly as safe as you may like to think it is. A new vulnerability has been found that allows anyone to bypass that lock and get full access to your phone, contacts list, and even photos.

The way it works is like this. Let your phone lock to where you need to put in your passcode to unlock it. Swipe your finger to bring up the passcode screen. Press "Emergency Call." Now type in any numbers, stars or pound signs work too. This is the important part, press the call button and immediately press the sleep button on the top of the phone. You should be taken immediately to the Phone app, where you can access your phone numbers, voicemail, and full contact list. In order to see photos, go to your contact list and press on someone. Now press "Share Contact" followed by "MMS." You will now be taken to a text message screen, where you can press on the little image of a camera and get to the photos on your phone.

Needless to say, this is a HUGE security hole, which can be used to access your personal information. We can only hope that Apple will be coming out with a security update soon to address this issue, considering the amount of internet media attention it has been receiving. The bug find is credited to Salomão Filho, who posted this video of himself giving a step by step tutorial on how to exploit it.


I have personally tested this on several of my friends' iPhone 3GS and iPhone 4 running iOS 4.1, and found that it is just as easy as it looks to break into a phone using this method.