×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

iOS 7 Lock Screen Bug Leaves Certain Apps Vulnerable For Access

Soulskill posted about 7 months ago | from the at-least-it's-a-flat-bug dept.

IOS 135

MojoKid writes "News of a proven security vulnerability involving Apple iOS 7 has started making the rounds. The exploit specifically involves the lockscreen, the most common piece of security that stops an unauthorized individual from gaining access to anything important on your phone. The 'hack,' if you want to call it that, is simple: Swipe up on the lock screen to enter the control center, and then open the alarm clock. From there, hold the phone's sleep button to bring up a prompt that will ask you if you wish to shut down, but instead of doing that, hit the cancel option, and then tap the home button to access the phone's multi-tasking screen. With access to this multi-tasking screen, anyone could try opening up what you've already had open on your phone. If you had Twitter open, for example, this person might be able to pick up where you left off and post on your behalf. Or, they could access the camera — and of course, every single photo stored on the phone." The new iPhone models were released today; iFixit has a teardown of the iPhone 5s, giving it a repairability score of 6/10.

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

135 comments

Protect your iPhone with a host file (1, Funny)

Anonymous Coward | about 7 months ago | (#44901695)

In loving memory of apk.

Re:Protect your iPhone with a host file (0)

Anonymous Coward | about 7 months ago | (#44902067)

APK died? Or was institutionalized?

Re:Protect your iPhone with a host file (0)

Anonymous Coward | about 7 months ago | (#44902661)

Either is fine, as long as it's permanent.

Re:Protect your iPhone with a host file (0)

Anonymous Coward | about 7 months ago | (#44903075)

It's not fine if you idiots continue mentioning him, it's still pointless spam.

With the NSA storing your every move (3, Insightful)

Mister Liberty (769145) | about 7 months ago | (#44901767)

this is the least of your worries.

Re:With the NSA storing your every move (4, Insightful)

Sockatume (732728) | about 7 months ago | (#44901783)

You know, because that applies to every security story and adds no specific value to any of them, you just have to say it once and then stop.

Re:With the NSA storing your every move (3)

MightyYar (622222) | about 7 months ago | (#44901863)

It is annoying. This overreach is even one of my pet causes, but this spam makes people who think it is dangerous look bad.

Re:With the NSA storing your every move (4, Insightful)

Sockatume (732728) | about 7 months ago | (#44901991)

My chief complaint is that it's an either-or proposition which makes it seem like we should just disregard all other security failures just because we're operating under a single massive one.

Re:With the NSA storing your every move (1)

MightyYar (622222) | about 7 months ago | (#44902061)

Yes, they can't really believe that - they are just trying to inject their pet cause everywhere... as if Slashdotters aren't aware already. It's like the Bush trolls from a few years back.

Re:With the NSA storing your every move (0)

Anonymous Coward | about 7 months ago | (#44904751)

With the NSA storing your every move

Wrong.

The iphone stores your every move, sends the data to Apple, then Apple hands it over to the NSA.

Reminds me of this Windows gif (5, Funny)

mystikkman (1487801) | about 7 months ago | (#44901797)

Windows login gif.

http://i.imgur.com/fqjnK.gif [imgur.com]

Re:Reminds me of this Windows gif (0)

Anonymous Coward | about 7 months ago | (#44902331)

Sad sign when I see the same top comments on Reddit show up on the Slashdot version of the article 7 hours later.

Re:Reminds me of this Windows gif (0)

Anonymous Coward | about 7 months ago | (#44902463)

Be honest. Everyone here probably spends more time on reddit.

Re:Reminds me of this Windows gif (0)

Anonymous Coward | about 7 months ago | (#44902579)

"le monkey face"..? no.

Re:Reminds me of this Windows gif (1)

Bogtha (906264) | about 7 months ago | (#44903241)

That's a bit complicated isn't it? I know in a lot of versions, you could just hit escape and you'd be dumped onto the desktop.

Could not replicate (as many others can't) (0)

Kaleidoscopio (1271290) | about 7 months ago | (#44901813)

I'm using IOS 7.0 (11A465) on a iPhone 4S.
I've tried to do the hack for half an hour and the phone will never bypass the lock.
There was also a rumor about taking a picture then sharing it thus accessing your contacts, but then again that is not true. The phone will not allow you to share or send a picture until it's lock has been removed.
People are getting this truly out of proportion, why do they care so much about the locking ability of a phone?
If I was a thief and I really wanted your data/phone, I would just start breaking your fingers until you gave it all.
If you are truly the paranoid kind, why do you keep a smartphone in the first place?

Re:Could not replicate (as many others can't) (2)

Bill_the_Engineer (772575) | about 7 months ago | (#44901853)

Because those of us who value privacy would like our phones to remain locked until we unlock it ourselves. I'd hate to have my email accounts and photos read or copied simply because I misplaced my phone and someone else found it.

Re:Could not replicate (as many others can't) (2)

Sockatume (732728) | about 7 months ago | (#44901871)

No luck on the iPhone 4 either. I wonder if there's some configurational wrinkle that's missing.

Re:Could not replicate (as many others can't) (3, Informative)

denmarkw00t (892627) | about 7 months ago | (#44904831)

I tried a good 10 times on my 4 before I got it to work - it's not mentioned and an easy bit to miss in the video: as soon as you tap close you have to do the double-tap on the home button and hold the second tap a little longer than a second maybe. The key though is to do this AS SOON as you hit "Cancel." How this person ever came across the flaw is beyond me, but good poking. Someone should hire her for a QA team.

Re:Could not replicate (as many others can't) (1)

thisisnotreal (888437) | about 7 months ago | (#44901881)

It is disappointing, but true.
Phone security will never be, and we should acknowledge it then.
I guess...that's the thinking.
Then the question is just how insecure are we okay with?

iPhone 4 cannot replicate (0)

Anonymous Coward | about 7 months ago | (#44901933)

see subject

Re:Could not replicate (as many others can't) (0)

Anonymous Coward | about 7 months ago | (#44901973)

Works for me on a regular 4. You cannot launch new apps but previoulsy opened apps that are running are accessible.

Re:Could not replicate (as many others can't) (2)

93 Escort Wagon (326346) | about 7 months ago | (#44903875)

Works for me on a regular 4. You cannot launch new apps but previoulsy opened apps that are running are accessible.

When I tried it (on an iPhone 5), it does seem - as in the demo video - the apps have to have been opened very recently.

This seems to be related to how iOS 7 handles multitasking. I wonder if disabling background updating of apps would fix it? Later yesterday (after I played around trying to replicate this bug) I disabled background updating, mainly to try to address the poor battery life suckage iOS 7 seems to have introduced on my phone...

Re: Could not replicate (as many others can't) (1)

DigiShaman (671371) | about 7 months ago | (#44904987)

Settings --> General --> Accessibility --> Reduce Motion -- turn on

The novalty wears off the first day or so, that and I don't like my wallpaper stretched causing them to blur (pixels no longer 1:1 ratio).

Re:Could not replicate (as many others can't) (1)

SROL (1164983) | about 7 months ago | (#44902411)

I was able to replicate it on the iPhone 4s.
On my first try the programs showed up for half a second then it went back to the lock screen. The second try it worked just fine but when I tried to open the "desktop" (I'm new to the phone so I don't know the right word) it locked again.

Re:Could not replicate (as many others can't) (0)

Anonymous Coward | about 7 months ago | (#44902621)

I tried this on my 4s and found it was difficult but not impossible to reproduce. I watched the video on the linked article and I noticed the trick is to double tap the home button very quickly after pressing cancel. I think you're accessing the multitasking menu while the animation is taking place in between canceling and it going back to the clock, so the window is tiny. I was only able to reproduce it about 10% of the time.

Re:Could not replicate (as many others can't) (0)

Anonymous Coward | about 7 months ago | (#44902727)

I was able to replicate it on my phone and my coworker's phone. I was also able to email a photo I had taken yesterday, without unlocking the iPhone, to someone else. Ultimately, my coworkers and I decided to Disable the Control Center function on the lock screen until the OS is patched.

I was able to unlock an iPhone 4s and iPad Mini both with iOS 7.0 and a coworker did an iPad 2.

You have to be quick between the Cancel and double tap of the home button. Not all the apps are impacted (I only found the Camera app to be impacted and none of the other apps I use would respond to attempts to access via this method).

What we found is, if the camera app isn't opened (you've specifically terminated the app while the device was unlocked), you can open the camera while it is locked, do the steps for the bug, and gain access to the photos that should be protected. Once you get to those photos, you can email them out under the users email account (as long as it doesn't require a password to email them out). You might be able to tweet or FB them but I didn't go that far.

I'd post under my registered id but I'm too lazy to get the password for my ./ account reset.

So, whether you can repeat it or not, I would recommend disabling the Control Center function on the lock screen because there are some of us out here who can do it if we get your phone and they probably won't be a nice as I am and not take all yer photos. Stay safe, keep your iOS device on you and out of other people's hands, and disable the control center on lock screen until a patch is ready.

Re:Could not replicate (as many others can't) (1)

Anonymous Coward | about 7 months ago | (#44902919)

iOS 7 on iPhone 5:

Swipe up, clock app, sleep button, cancel out of the power off dialog, hit the home button twice. Yes, one can swipe and see what apps were once run, but it will ignore any taps on other apps, and if one taps on the Springboard icon, it will drop back to the lock screen.

Yes, this is a bug, and hopefully 7.0.1 will fix it, but it doesn't allow anyone off the street to get to your contacts and such.

Re:Could not replicate (as many others can't) (0)

ArcadeMan (2766669) | about 7 months ago | (#44903105)

I also cannot replicate the problem with iOS 7.0 (11A465) on my iPhone 3GS.

Re:Could not replicate (as many others can't) (1)

rsborg (111459) | about 7 months ago | (#44904429)

I also cannot replicate the problem with iOS 7.0 (11A465) on my iPhone 3GS.

If you don't mind me asking - how'd you get that installed - isn't iOS7 not supposed to be compatible for 3GS.

Re:Could not replicate (as many others can't) (0)

cellocgw (617879) | about 7 months ago | (#44903423)

itsatrap

You can't bypass the lock, but you did activate the hidden Trojan that now will send all your BitCoins to the guys who posted this phony (pun intended) hack.

Re:Could not replicate (as many others can't) (1)

thoromyr (673646) | about 7 months ago | (#44903515)

There is a bug, but it is not what most would consider a lock screen bypass. iOS7 has a new task switcher and you can access this, but it has reduced privileges meaning you can't access any app that you couldn't from the lock screen. And even then it isn't reliable (very likely due to it being the result of a bug).

What it *does* do is leak information about what is installed on the phone, and badges for installed apps (e.g., number of unread emails). But only if those applications are running. Doing a fresh upgrade from 6 to 7 somehow resulted in every application being listed by the task switcher -- its as if they were all started by iOS. You can remove the apps from the task switcher (killing inactive applications).

So, yes, there is a bug. No, it isn't a lock screen bypass. Other than some information leakage ("active" apps) there is no access that did not occur from the lock screen itself.

Re:Could not replicate (as many others can't) (1)

thoromyr (673646) | about 7 months ago | (#44903855)

Exploring this further, it appears that someone doing this casually may think they have a lock screen bypass because they go through the steps and get full access to any application. The key here is the behavior of locking the phone: is the passcode immediately required or not? If testing this you have to either set that to immediately or wait long enough to ensure it isn't still just "swipe to unlock".

On another note, some combination of factors resulted in no access to the quick swipe apps. Could still swipe to get the camera from its separate point

iOS vulnerability (0)

Anonymous Coward | about 7 months ago | (#44901835)

I just tried this on my phone and yes you could see the multitask but you couldn't do anything except go back to the alarm clock or lock screen as far as i could tell

Re:iOS vulnerability (1)

Joce640k (829181) | about 7 months ago | (#44901925)

Summary says you have to have applications open.

Re:iOS vulnerability (0)

Sockatume (732728) | about 7 months ago | (#44901961)

It's iOS. Nothing is open ten seconds after the phone is locked.

Re:iOS vulnerability (0)

Anonymous Coward | about 7 months ago | (#44902141)

Score: -1 Factually Incorrect

Re:iOS vulnerability (1)

Sockatume (732728) | about 7 months ago | (#44902239)

Ten seconds is the time limit given for an app to finish its business if it ceases to be in the foreground or the phone screen is locked. I don't think background services or the brief window in which a compatible app is restarted for Background App Refresh really count.

Re:iOS vulnerability (0)

Anonymous Coward | about 7 months ago | (#44903831)

Being active on the CPU, and being running are two entirely different things. Applications remain resident in memory, and running, just not scheduled in. The only way they close is if they are jettisoned for using too much memory, which becomes more likely when they're backgrounded, but far from guaranteed.

I thought Tim Crook was doubling down on security? (0)

Anonymous Coward | about 7 months ago | (#44901867)

Guess he should have doubled up instead!

Can't replicate (4, Informative)

jamie (78724) | about 7 months ago | (#44901875)

I can't replicate it either. The YouTube video claims I double-tap the home button but the second tap is slightly longer? By the end of the first tap it's already bringing me back to the lock screen, i.e. by the time I'm pressing down for the second tap, I'm already being taken back to the lock screen. iPhone 5, updated last night to 7.0 (11A465).

Re:Can't replicate (2, Informative)

Anonymous Coward | about 7 months ago | (#44901993)

you must be quite fast between cancel and double tap

Re:Can't replicate (0)

Anonymous Coward | about 7 months ago | (#44902105)

you must be quite fast between cancel and double tap

Jamie prolly lasts that long in bed w. Cmd. Taco.

Re:Can't replicate (1)

Anonymous Coward | about 7 months ago | (#44902207)

Got It!,

but on my iphone 5 I can do nothing with it. I can see what apps are open. I cannot see their content and I cannot open any of them, and if if I play around in there too long it goes back to the lock screen.

I don't know if there is anything to see there.

Re:Can't replicate (1)

asylumx (881307) | about 7 months ago | (#44903239)

Just tried this with a co-worker's iphone and yes, if the camera was running you can access all of their previous pictures. Couldn't get it to load their contacts, though.

Re:Can't replicate (2)

ageoffri (723674) | about 7 months ago | (#44903741)

I was able to access contacts indirectly. Go into the gallery and share a picture and use messaging. At this point hit the + sign in the upper right. You are then in Contacts. You can view names and phone numbers. I wasn't able to figure out a way to edit contacts or get more details.

Re:Can't replicate (0)

Anonymous Coward | about 7 months ago | (#44904829)

I had success followed those instructions. I could see all the email addresses by sharing the photo via email and typing @ for the email address.

I could also post to twitter and facebook, delete pictures, edit the photos, make new photo streams etc..

Re:Can't replicate (1)

Like2Byte (542992) | about 7 months ago | (#44903363)

I was able to replicate this with caveats.

I was able to replicate this WITHOUT having the 'Passcode Lock' enabled.

I was UNABLE to replicate this WITH 'Passcode Lock' enabled.

I've now restarted an iPad Mini and am STILL UNABLE to replicate with the 'Passcode Lock' enabled.

I'm not sure what the problem with this feature is. Sure, they've 'bypassed' the swipe to unlock screen; but, the user has specifically poked and prodded this iPad Mini in what, I assume, is an extremely unlikely situation. By itself I'm not so sure this is such a major problem. If it had gotten around the 'Passcode Lock' then yeah; but, it doesn't seem to.

Re:Can't replicate (1)

Like2Byte (542992) | about 7 months ago | (#44903455)

KABOOM! I read some of the other posts. You DO have to double-tap the home button in really fast succession.

So, scratch my previous post.

I was able to replicate this WITHOUT having the 'Passcode Lock' enabled with a single home button tap.

I was also ABLE to replicate this WITH 'Passcode Lock' enabled with a double-tap of the home button. However, I was unable to access any of the open applications from the multi-tasking screen.

Re:Can't replicate (0)

Anonymous Coward | about 7 months ago | (#44903547)

Same here, I could not access apps but I could access camera and all pictures...

iFixit (4, Funny)

Sockatume (732728) | about 7 months ago | (#44901879)

From iFixit's teardown:

We are currently involved in heavy lobbying to our product designers to create 14k gold replacement screws. They'll be $50 each and strip the first time you try to unscrew them, so they will be perfect for the iPhone. Stay posted.

Ha ha ha.

Re:iFixit (1)

AmiMoJo (196126) | about 7 months ago | (#44904719)

From the same teardown:

Perhaps the "s" in 5s stands for "stuck," as in "this battery is stuck in with a lot of glue," or "I hope you didn't want to replace your batteryâ"you're going to be stuck with this one."

They just couldn't resist, could they?

iPhone 4 cannot replicate (0)

Anonymous Coward | about 7 months ago | (#44901957)

No joy.

This sounds vaguely familiar (1)

Valgar (225897) | about 7 months ago | (#44902047)

Not quite the same, but this sounds somewhat like the old iPad smart-cover bypass trick from a couple years ago.

http://www.theguardian.com/technology/blog/2011/oct/26/ipad-lock-bypass-ios5-cover

Easily avoided (1, Informative)

Mendenhall (32321) | about 7 months ago | (#44902081)

As soon as I did the iOS7 update, I noticed that you could access the camera from the lock screen, and I didn't want someone taking inappropriate pictures on my iPad if they stole it. There is an option in the settings which controls what features are available from the lock screen. If you turn off the Control Panel access from the lock screen, and everything else, this goes away.

So, it's annoying but not fatal as a security issue. I can't imagine anyone wanting to have the device open for the camera when it is locked. I do wish the options were flexible enough that one could still adjust audio settings with it locked.

Re:Easily avoided (3, Interesting)

Culture20 (968837) | about 7 months ago | (#44902165)

There are plenty of people who want an instant camera instead of fumbling with passcodes and opening the camera app for 30 seconds.

Re:Easily avoided (4, Informative)

joh (27088) | about 7 months ago | (#44902237)

As soon as I did the iOS7 update, I noticed that you could access the camera from the lock screen, and I didn't want someone taking inappropriate pictures on my iPad if they stole it.

You could access the camera from the lock screen from iOS 5 on.

Re:Easily avoided (0)

Anonymous Coward | about 7 months ago | (#44902249)

As soon as I did the iOS7 update, I noticed that you could access the camera from the lock screen

It was already there is the previous iOS6 update.

Sheesh... don't people actually look at their phones anymore?

Re:Easily avoided (1)

Sockatume (732728) | about 7 months ago | (#44902253)

You could access the camera from the lock screen on the iPhones for a while, is this new to the iPad?

Re:Easily avoided (1)

Somebody Is Using My (985418) | about 7 months ago | (#44902833)

You could access the camera from the lock screen on the iPhones for a while, is this new to the iPad?

Yes, it is new to the iPad.

The iPhones (and the forgotten stepchild of the line, the iTouch) had a camera button on the lock screen, but - on IOS6 and below - you did not have this feature on the Ipad.

On the other hand, you did get the stunningly useless "picture frame" button on the iPad lock screen. You know, for those times the battery wasn't draining fast enough on its own. That's disappeared with iOS7

The camera icon on the lock page is new to the iPad. I guess Apple didn't actually expect people to regularly use the iPad as a camera as it's a bit bulky for that purpose; still, I see folk doing it all the time so I suppose it's a needed addition.

IOS7 has some very nice features (I particularly like the new multitasking system and the control center). I just wish they'd let people create their own themes so I wouldn't have to use those horrible new icons. Aside from the terrible color scheme, legibility and recognition are shot to hell with this update...

Re:Easily avoided (1)

parkinglot777 (2563877) | about 7 months ago | (#44902357)

As soon as I did the iOS7 update, I noticed that you could access the camera from the lock screen

That feature has been included even before iOS7. I could already access the camera in my phone (4S) with only iOS5.x by turning the lock screen on and then swipe the camera icon upward to open the camera functionality. I could also access all pictures taken from this session of the camera as well. However, I cannot access any other pictures taken outside of the session. In other words, other pictures that are already in the photo gallery before turning the camera functionality on from the locked screen are inaccessible unless I unlock the phone. This is NOT a NEW feature.

Re:Easily avoided (0)

Anonymous Coward | about 7 months ago | (#44902393)

If you turn off the Control Panel access from the lock screen, ...

So, it's locked, except that you can immediately change the phone settings without bothering to unlock it?

That's like letting people set a new password for an account before asking them to log in.

Please tell me I'm reading this wrong and that there is actually someone at Apple with more mental capability than a toddler.

Different thing altogether... (3, Informative)

Thruen (753567) | about 7 months ago | (#44902427)

Couple quick things. Firstly, that feature was already there, odds are you had disabled it before and that setting was reset with the update. Also, you can't access any existing photos from there, it'll only let you browse the photos you've taken since opening the camera, and resets each time you lock the screen again. There are similar features on other phones, it's handy and not by itself a security risk. As for not imagining anyone wanting to have the device open for the camera when it's locked, I think you lack imagination, and possibly even basic sense. I take advantage of it most frequently when I'm traveling and wish to quickly snap a photo without having to type in my password, it often makes the difference between a photo of an animal grazing and one of their behind as they run into the woods.

It's worth noting that this feature doesn't seem related in the least to the security flaw discussed here, as the camera is meant to be quickly accessible in this way. This means the suggestion of turning off control panel access won't fix the security flaw, if that's what you had in mind.

Re:Different thing altogether... (1)

Mendenhall (32321) | about 7 months ago | (#44902519)

I know they are different things, but it was the camera access that got my attention. Disabling Control Panel access, I think, as I mentioned in the original post, avoids the issue. As far as I can tell, there is no way to get to anything on my iPad without unlocking.

The ad hominem about my lacking imagination and/or sense was not needed or polite.

Re:Different thing altogether... (1)

Thruen (753567) | about 7 months ago | (#44902849)

I'm not sure if I misunderstood you then or now, but if you understand the article is about something entirely different than the feature you describe then I'm not sure why you bothered to mention it, as it has nothing to do with the article. I'm not shocked you weren't able to reproduce the issue on your iPad, as it seems to be a problem specifically with the iPhone 5S, as described in the article, and there are reports around the web of being unable to reproduce it on other devices.

Also, it's amusing that you mention my ad hominem as unnecessary, when it was in response to your own, and you responded to it with another. Maybe you should run your own blog with comments disabled if you want to be able to post your opinion on the internet and have nobody respond to it. If you find a tame comment like that offensive, public forums are no the place for you.

Re:Different thing altogether... (1)

narcc (412956) | about 7 months ago | (#44904923)

Why is this [plover.net] so damn difficult for people to understand?

Both of you, stop it!

Re:Easily avoided (1)

jellomizer (103300) | about 7 months ago | (#44902535)

"I can't imagine anyone wanting to have the device open for the camera when it is locked."

Well some people want to take pictures right away, before having to type in a password to get to it. Taking inappropriate pictures on your phone/ipad is easily deleted once the damage is done. This was on iOS 6 too.

Re:Easily avoided (1)

ozbon (99708) | about 7 months ago | (#44902981)

You could access camera from lock screen in iOS6 too - it's not a new feature.

Re:Easily avoided (1)

tlhIngan (30335) | about 7 months ago | (#44904125)

I noticed that you could access the camera from the lock screen

While it's elegantly done on iOS (swipe up to activate camera versus right when unlocking), on Android, this one feature (introduced in Jellybean 4.2) is probably implemented in the most asinine fashion.

In 4.2, they turned the lock screen into another home screen with limited privileges, so they added pages to the left and right of the lock (left page(s) - user defined widgets, right page - camera). The problem is if you're using the swipe code and start the swipe on the sides, you can easily go "too far" to the left and right and end up changing the lock screen page instead of unlocking the phone. Most annoying. There are fixes to it (there's an app that disables widgets and camera auto-activation this way), but it's a huge PITA as 4.2 makes the unlocking area much smaller.

Of all the iOS features Android could've taken, they take and implement poorly the camera on the lock screen

Already fixed today (1)

wimmi (263136) | about 7 months ago | (#44902115)

It's supposed to be fixed in 7.01 which should be available today..
Or so I've read from various sources.

Re:Already fixed today (1)

Sockatume (732728) | about 7 months ago | (#44902155)

Apple have acknowledged the issue and that they intend to fix it, however 7.0.1 is a bug fix release for the 5C and 5S to make up for the fact that their builds are older. (They had to be finished in time to get the phones into boxes and shipped to stores.) I would be surprised if 7.0.1 did anything but bring those two handsets up to date, this bug included.

Yes, it invoked the multitasking screen but... (0, Troll)

dadman (576569) | about 7 months ago | (#44902117)

nothing except the following leaked:
1. The home screen and its icons
2. The app history

Nothing about the content of the app is available on the multitask screens, not even the titles.

" If you had Twitter open, for example, this person might be able to pick up where you left off and post on your behalf. Or, they could access the camera — and of course, every single photo stored on the phone." -- Speculations, and speculations, and more speculations, but definitely not true!

Security issue? Yes. Serious? So so. Disastrous? Not.

Re:Yes, it invoked the multitasking screen but... (3, Interesting)

MrP- (45616) | about 7 months ago | (#44903209)

Yeah I got the same. I can see the apps and can close them but most are just dark blank screens and not the actual app and none can open. The only thing that opens is the alarm app and if you click the home screen one it just goes back to the lock screen.

As far as I can tell as long as your lock screen is password protected it won't show any part of the app other than the initial view (e.g. a blank safari, or a splash screen of the app). So for example if you were viewing an email it doesn't seem the email will be visible in the multitask screen.

Now if you're not password protected (either off or you don't require a passcode immediately) and do the same trick the multitask screen shows everything and you can switch apps but that's fine since you can already unlock without a password.

So it doesn't seem to be that big of an issue.

Re:Yes, it invoked the multitasking screen but... (1)

MrP- (45616) | about 7 months ago | (#44903303)

Actually the only security problem seems to be the Camera app. Since the camera app is allowed from the lock screen if you open it via the multitask screen while using this trick it opens the full camera app.

Normally the camera app when password protected can take new photos and can't access old ones but when you do it this way you have full access to the camera roll. You can delete photos, share them (txt, email, twitter, facebook, etc).

So that's a security issue.

Re:Yes, it invoked the multitasking screen but... (0)

Anonymous Coward | about 7 months ago | (#44903711)

If the app in question is a banking app, that is potentially disastrous to an individual.

I just got off the phone with a relatively large regional bank, trying to explain to their technical people why it's NOT OK that the new multitask browser provides an unprotected preview of my last banking session. They seemed to think that it was OK, and I hope the escalation finds the right people.

Can't Reproduce (1)

Sylak (1611137) | about 7 months ago | (#44902169)

I can't reproduce this. Is is possible it's specific just to the iPhone 5/s/c?

Re: Can't Reproduce (0)

Anonymous Coward | about 7 months ago | (#44902361)

Works on the latest iPad. I was able to view photos through multitasking (camera app was open before lock). Other open apps visible, but greyed out and inaccessible.

Re: Can't Reproduce (0)

Anonymous Coward | about 7 months ago | (#44902443)

In addition, it apparently can only be done once per initial lock. After accessing camera roll, exiting and then going back to lock screen, the bug would not repeat. after unlocking and locking again it would.

Unimpressed. (1)

MaWeiTao (908546) | about 7 months ago | (#44902423)

I spent most of yesterday evening tinkering with iOS 7 on my iPad. I've got to say, much of it feels like amateur hour, like a bunch of students got together to create a redesign of iOS. I can't tell if they put an inexperienced team on the job, if managers with no proper UX experienced were meddling, or they outsourced the bulk of the work. But as a creative director I would have rejected much of what I was seeing and I can't imagine that Steve Jobs would have approved this release.

Apple, a company supposedly reputed for being a stickler about the details, sure overlooked a lot of things here. So that there's a vulnerability isn't really shocking at this point.

Re:Unimpressed. (0)

Anonymous Coward | about 7 months ago | (#44904233)

Your post contains no insights and no information whatsoever. You are ranting about your personal feelings, without substantiating anything or even describing your observations about the OS.

I spent most of yesterday evening tinkering with iOS 7 on my iPad. I've got to say, much of it feels like a work of art, like a bunch of UX geniuses got together to create a redesign of iOS. I can't tell if they put their most talented and experienced team on the job, if managers with overwhelming UX experience and a vision were leading the team, or they outsourced the bulk of the work to UX gods. But as a creative director I would have climaxed by just having a short glimpse of iOS7 and I can't imagine what God almighty Steve Jobs would have said during the keynote of such a masterpiece.

Re:Unimpressed. (0)

Anonymous Coward | about 7 months ago | (#44904949)

Yes. I agree. It feels unfinished in lots of places and just plain bad in others. A lot of places are very difficult to read due to the razor thin fonts and symbols. There are many places where there is a razor thin font combined with a light grey color on a very white background. This translates to such a reduced contrast that I (and others that I've shown it to) find it difficult.

Everywhere there are menus with just a skinny font on white. Barren, boring and lifeless.

I gave it my best for a few days then thankfully downgraded to 6.1.3. Yes the skeumorphism is a bit overdone in this old version, but as much as 6.1.3 is to far in one direction, 7 is too far in the other.

The iPhone 4 was my last iPhone. Going to switch! (-1)

Anonymous Coward | about 7 months ago | (#44902537)

Honestly!

I had many iPhones before and I always liked their way of simplicity and intuitive easy of use. Sadly with the new iOS 7 and the horrible prices of the new models of phones a border has been crossed. I sat down the past few days and thought about alternatives. One alternative was to switch to an normal Phone without any bells and whistles (Like the Nokia 100 for a few bucks) or maybe giving Android a chance.

I still had very bad experiences with Android 2.2/2.3 on an Yarvik Tab 410 therefore I was quite curious whether I should ever give an Android phone another try or not. Then I started to watch some reviews of Samsung S4, HTC and that Google Phone (Nexus) I belive. I also looked at some Cyanogen reviews... ... the conclusion was "Wow".

Yes a simple WOW and END. After all the years I only cared for Apple iPhones and Apple Apps and always had the bad experience with Android 2.2/2.3 in my mind and now - with all the reviews that I saw I ended up speachless. Still I can't value the usability of the new Android versions over the usability till iOS 6 but from it's looks the new versions really gained momentum.

I really don't know what's inside the head of Apple increasing prices with every phone. Pulling the old iPhone 5 in a plastic Cage and selling it as some brand new. I also don't get what drove them nuts with the new horrible Design *cough* that is called iOS 7 with all these crappy icons. Whoever is resposbile for this horrible experience should be thrown out of Apple instantly. To say: I won't switch to iOS 7 until something happens. Till then I still keep iOS 6.

What also pisses me off right now is all these "app style switches" from all these one man companies. Without even taking care of their existing customers they rush out halfbacked "conversions" of the new iOS 7 styles rendering it's usability totally useless for all those people who still plan and enjoy iOS 6. These one man companies even don't announce any changes. They silently provide updates. I already have some beef with some of these developers because I paid money for the apps and somehow being forced by Apple to update - to avoid getting the red button showing me the left updates.

There were no clear rules set up by Apple how developers should deal with the new and old design of apps. Some companies and 3rd party developers at least made their app depend on iOS 7 - which somehow is a good as well as bad thing. Some other companies simply applied a new app to the app store so people using iOS 6 can still enjoy the other version of the app (still maintained), whether the new ones with iOS 7 switch to the new design.

I am quite upsed and pissed off to deal with "maintaining" my phone all the time rahter than using it. Honestly I also feel sorry for all those folks following Apple like an religion by standing in line for the new phone for quite a few hours only to be "first". I wonder whether these people actually do this because they "want" it (addiction), or because Apple is some sort of religion.

Valuing my money and having kids, I also need to look over the border and started to realize, that there is much more happening by competition to a more suitable price.

That's what I had to get rid. Thanks for reading.

Re:The iPhone 4 was my last iPhone. Going to switc (0)

Anonymous Coward | about 7 months ago | (#44902563)

Btw: I am no native english speaker, so please pardon!

Re:The iPhone 4 was my last iPhone. Going to switc (0)

Anonymous Coward | about 7 months ago | (#44902715)

Then don't buy an iPhone, thats the beauty of a free market don't buy what you don't want. I look at Android and go WOW too, wow as in terms of crapastically cheap looking and god awful UI, which is why I won't buy an android or another for my wife.

can't replicate (0)

Anonymous Coward | about 7 months ago | (#44902685)

i can't replicate this when a passcode is enabled. and if a passcode is not enabled, why go through all those steps to get to the multitask screen when all you need to do is slide from left to right?

It's worse than I thought but easy to fix (0)

Anonymous Coward | about 7 months ago | (#44902787)

If settings is one of the apps the user had open, you can preaty much own the phone.

You can also plug the hole by disabling the ability to open the control center from the lock screen.

Cemaco

No M7 processor? (1)

UnknowingFool (672806) | about 7 months ago | (#44902901)

This is strange that they couldn't find the M7. Either it is incorporated into the A7 or they missed it somehow. Given the functionality of the M7, it might very small compared to the A7. There appears to be some metal shielding next to the A7. It could be under there. Also the chip next to the Qualcomm WTR1605L isn't identified.

Re:No M7 processor? (1)

tlhIngan (30335) | about 7 months ago | (#44903911)

This is strange that they couldn't find the M7. Either it is incorporated into the A7 or they missed it somehow. Given the functionality of the M7, it might very small compared to the A7. There appears to be some metal shielding next to the A7. It could be under there. Also the chip next to the Qualcomm WTR1605L isn't identified.

Not really. It's probably part of the silicon that the A7 uses - modern ARM SoCs are full of processors besides the main ARM core - often many auxiliary processors exist. The M7 is probably just another block on the silicon.

In fact, it's not entirely surprising if you find a small ARM core is the only thing that boots when you apply power - the main big beefy cores are kept in reset and power down states. The little ARM core (ARM11 in some cases or a Cortex-M ARM microcontroller in other cases) boots up and is responsible for initializing the system and loading the next block of code up and preparing the main cores to boot it.

Heck, one SoC I worked on had 8 cores (for big.LITTLE), a Cortex-M core to boot and manage power, and a Cortex-R core for modem functionality.

It won't be out of place for Apple to put it on the came silicon. It would just be another programmable processor in a sea of them that makes up a modern SoC.

Camera access is the gateway (0)

Anonymous Coward | about 7 months ago | (#44903229)

I've gotten this to work consistently and the key vulnerability here is through the camera. When you bring up the multitasking screen, most apps aren't accessible, but you can access the camera. Unlike the normal lock-screen camera access where you can shoot pictures but not see any photo history other than the shots you took during the current session, by accessing through this hack you can see the entire photo history. Also, you can access the "share" options for camera photos which means you can send emails from the phone, post to Twitter, Facebook, etc.

Turn off control centre (0)

Anonymous Coward | about 7 months ago | (#44903527)

Turn off the control center from the lock screen. It's not bad practice anyway.

Auto lock timeout (-1)

Anonymous Coward | about 7 months ago | (#44904113)

I am almost positive that his "bug" is simply people's auto lock timeout setting being too long. I just confirmed that if you set your passcode to be required immediately that this hack will not work. However, if you set it to something like 2 minutes, as long as you're within the 2 minutes, you can get this to work.

Anyone else experience that?

To replicate, you must first type in passcode (-1)

Anonymous Coward | about 7 months ago | (#44904139)

Like in the video, you must first type in the passcode. This unlocks the passcode feature.
After that, the phone is not locked until auto lockout.. minimum of one minute.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...