7 ms·

Secret Button Sequence Bypasses iPhone Security

106 points by georgecmu 16y ago

iAmSpartacus 16y ago
Works on my 3G!
ssclafani 16y ago
It's been fixed in the 4.2 beta.
- georgecmu 16y ago
  Can you share a link to the announcement?
  - ssclafani 16y ago
    No official announcement. Multiple people on different forums running the beta have said that it doesn't work.
  - jayphelps 16y ago
    It hasn't been offically acknowledged by Apple, but I can confirm this doesn't work in the 4.2 beta as well. For obvious reasons, Apple prolly hoped this one would slip past everyone undetected until they pushed the next update out.
- jayphelps 16y ago
  True, but nonetheless hilariously bad mistake. Really, this is only a security threat to your tech savvy gf/bf/friend/thief since it requires physical access. And you know what they say anyway: Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore
  - icegreentea 16y ago
    It'll make corporate iPhone users (well, more the IT departments really) think twice (again??) about their iPhones on their network. For all the crap that RIM gets, they do get the whole corporate environment and security lock down thing right.
    - sprout 16y ago
      I think iOS was already on every sysadmin's shitlist for quite a while. I remember some of my friends on the networking side complaining a good deal about the iPad's DHCP lease shenanigans.
  - kenjackson 16y ago
    Is Law #3 really true for this iPhone scenario? I get that the bad guy should have access to the data on the machine, but should they be able to log into your account and impersonate you? Even with physical access that should NOT be possible.
davej 16y ago
By the way you can dial anything, it doesn't have to be three pound signs.
MrFlibble 16y ago
Sure it's a neat backdoor, but does it play Global Thermonuclear War?
staunch 16y ago
This is one of those rare kinds of mistakes where I really believe someone's head should roll. They gave away the privacy of potentially millions of people. It will have real world consequences for some of them.
- jayphelps 16y ago
  If you know someone who would do malicious things with your contact list, I think you've got bigger problems. And playing devil's advocate, sure a thief could steal your phone and use this exploit (if he even knew about it), but what's he going to do with the contact list? If someone steals your iPhone, they did it to wipe it and resell it. There are much, much easier and less risky ways of getting large lists of people's contact info if that's what they're after. Programmers make mistakes. Saying they should get fired over this is a bit silly, IMO. EDIT: I'm not trying to downplay the seriousness. It's definitely serious. I've known some people who would use this against their "cheating" girlfriend in a heartbeat to see who they've been calling. But I seriously doubt anywhere close to millions will be affected.
  - corin_ 16y ago
    I seriously doubt anywhere close to millions will be affected. In his defense, he was saying that the privacy was potentially compromised, not that they would be affected. All iPhone users have had their privacy potentially compromised.
  - uptown 16y ago
    Okay, how about this scenario. Someone with access to someone's office steals their phone and sells it or its information to the highest bidder. I used to work in the same building as FOX News. One day Rita Cosby's Blackberry showed up in our office space ... totally separate elevator banks, different floor, different everything. Our best guess was that someone from the cleaning crew grabbed it, got scared, and ditched it, but someone with other motives could do some serious damage in a day where smartphones provide portable access to a massive amount of personal and private information.
a2tech 16y ago
After maybe 30 seconds it automatically returns to the lock screen-in fact I was barely able to get to a contact before it locked again
- extension 16y ago
  Really? I'm seeing something very different. Not only is it not timing out, but I can't even lock it again manually. Neither the home button nor lock button do anything (except take a photo if I press them both, which I just now discovered). EDIT: I can re-lock it by holding Home to get to voice control, then cancelling that and pressing Home or Lock. EDIT2: It takes a screenshot, not a photo. Damn, photo would be way more useful.
- davej 16y ago
  When you're on the contacts screen, hold down the power button until the power-off screen comes up, then press cancel. That should stop it from going back to the lock screen.
bsk 16y ago
If you need a secure phone get a Blackberry ;)
sliverstorm 16y ago
Am I the only one who thought "wait, the iPhone only has one button..."
bradfordw 16y ago
up-up, down-down, left-right, left-right, b, a...
tptacek 16y ago
It's actually worse than the article suggests; from the phone app, you can get to Mail and SMS (Share Contact); from SMS, you can get to the phone's camera roll; I'd be surprised if URL expansion didn't get you to Safari via Mail or SMS. On the other hand, it's not like the keypad lock was Fort Knox. I don't even bother with it normally.
- chrisbolt 16y ago
  Just tried it, tapping URLs, email addresses, and physical addresses in the contact list doesn't do anything for me.
  - Xuzz 16y ago
    You can, however, use the "share contact" button to evade that.
- DrStalker 16y ago
  I bother with the keyboard lock to stop people grabbing my phone and tweeting "HA HA I SUCK BALLS!" before I notice what they're doing. It works really well for this purpose, but I wouldn't trust it to do much more.
- jkent 16y ago
  I don't agree that it's worse. I think it's mild. Call it a local-only data-exposing exploit. I find it best to keep the phone in my pocket. It also stops people from stealing it - a more common occurrence than hacking contacts.
Xuzz 16y ago
(Note: this is a pretty technical post.) The iPhone's passcode is pretty superficial. Only the UI code actually enforces it, and this is one of the results of that distinction. In fact, when you unlock, you are still viewing the same process as you were before it was unlocked. It just called the "_unlockWithSound" method and set an internal state to unlocked. Edit: as pointed out to me on IRC by comex (author of JailbreakMe), there is lower level protection in the "lockdownd" service, but since the UI controls that, it doesn't really provide any additional security except it blocks iTunes syncing and such). However, with this "hack", you are still locked, so you can't do anything like opening apps (again, the UI process locks opening apps, as part of their "security"). But, I did some experimentation, and here's what I found for impact: - You can read and edit contacts, of course. - I am not sure if phone calls work, but they didn't appear to. - While clicking an email address does nothing, clicking the "send contact" lets you send an email to whoever you want, custom address and all. - You can view all the photos by pressing the "add photo" on a contact you edit. You can also take new ones saved to there. - You can send SMS and MMS using the same method as for email, but selecting MMS. - You /cannot/ enter Safari or go to the homescreen: unless someone finds another similar "hack" to exit the app, as then you could see the icons (but, as the "is locked" flag is still "true", it won't let you launch apps). - FaceTime doesn't seem possible. This is a serious issue, and with the publicity it already has, I would only expect Apple to fix it (with a 4.1.1 firmware release, of course, I don't expect them to care about their iPhone 2G owners back on 3.1.3) within two weeks. However, if they want to fix this, they need to redesign the workings of the lock screen. The current way it works is incredibly simple to circumvent. Finally, on an unrelated note, the same exploits used in the jailbreak tools like "greenpois0n" and "PwnageTool" can be used to get around the passcode and get full filesystem access, or just remove it altogether. But you do need a computer for that, which you don't with this.
- jacquesm 16y ago
  Does this really qualify as pretty technical ? It's not exactly the guts of Haskell or Clojure or something like that.
  - whimsy 16y ago
tyrelb 16y ago
works for me! i wonder how many accidental 911 calls will be made from trying this...
- cmelbye 16y ago
  None, unless you enter "911" for some reason. If you type "###" it just says "Emergency calls only."
archangel_one 16y ago
This reminds me a little of jwz's comments on xscreensaver + toolkits: http://www.jwz.org/xscreensaver/toolkits.html http://www.jwz.org/xscreensaver/toolkits.html Although, while I don't really mind xscreensaver's unlock screen, I don't think Steve Jobs would give it the thumbs up :)
vidar 16y ago
Locks only keep honest people out.
IgorPartola 16y ago
I don't know about others, but I feel that the iPhone is a terrible phone to use in an emergency. I currently have a 3G which contributes to this, but it takes me at least 30 seconds to go from holding the locked phone (I have no pass code on it) to actually hearing the ring tone. I've had to dial 911 twice on it and it was not a quick experience and since the second time it was for someone who crashed their car head first into a tree right outside of my back yard it was kind of critical that I dial quickly.
kvs 16y ago
Reminded me of Epic Windows 98 Logon: http://i.imgur.com/JPxql.gif http://i.imgur.com/JPxql.gif
wazoox 16y ago
Doesn't work on the 3 jail-broken 3G/GS iPhone I tried (3.2 firmware).
eyeareque 16y ago
I can't seem to replicate it, but one time I was able to get to the home screen by double clicking the home button, switching to a different app, and then pressing home a single time to return to the home screen.

106 points by georgecmu 16y ago

iAmSpartacus 16y ago

Works on my 3G!

ssclafani 16y ago

It's been fixed in the 4.2 beta.

georgecmu 16y ago
Can you share a link to the announcement?
- ssclafani 16y ago
  No official announcement. Multiple people on different forums running the beta have said that it doesn't work.
- jayphelps 16y ago
  It hasn't been offically acknowledged by Apple, but I can confirm this doesn't work in the 4.2 beta as well. For obvious reasons, Apple prolly hoped this one would slip past everyone undetected until they pushed the next update out.
jayphelps 16y ago
True, but nonetheless hilariously bad mistake. Really, this is only a security threat to your tech savvy gf/bf/friend/thief since it requires physical access. And you know what they say anyway: Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore
- icegreentea 16y ago
  It'll make corporate iPhone users (well, more the IT departments really) think twice (again??) about their iPhones on their network. For all the crap that RIM gets, they do get the whole corporate environment and security lock down thing right.
  - sprout 16y ago
    I think iOS was already on every sysadmin's shitlist for quite a while. I remember some of my friends on the networking side complaining a good deal about the iPad's DHCP lease shenanigans.
- kenjackson 16y ago
  Is Law #3 really true for this iPhone scenario? I get that the bad guy should have access to the data on the machine, but should they be able to log into your account and impersonate you? Even with physical access that should NOT be possible.

davej 16y ago

By the way you can dial anything, it doesn't have to be three pound signs.

MrFlibble 16y ago

Sure it's a neat backdoor, but does it play Global Thermonuclear War?

staunch 16y ago

This is one of those rare kinds of mistakes where I really believe someone's head should roll. They gave away the privacy of potentially millions of people. It will have real world consequences for some of them.

jayphelps 16y ago
If you know someone who would do malicious things with your contact list, I think you've got bigger problems. And playing devil's advocate, sure a thief could steal your phone and use this exploit (if he even knew about it), but what's he going to do with the contact list? If someone steals your iPhone, they did it to wipe it and resell it. There are much, much easier and less risky ways of getting large lists of people's contact info if that's what they're after. Programmers make mistakes. Saying they should get fired over this is a bit silly, IMO. EDIT: I'm not trying to downplay the seriousness. It's definitely serious. I've known some people who would use this against their "cheating" girlfriend in a heartbeat to see who they've been calling. But I seriously doubt anywhere close to millions will be affected.
- corin_ 16y ago
  I seriously doubt anywhere close to millions will be affected. In his defense, he was saying that the privacy was potentially compromised, not that they would be affected. All iPhone users have had their privacy potentially compromised.
- uptown 16y ago
  Okay, how about this scenario. Someone with access to someone's office steals their phone and sells it or its information to the highest bidder. I used to work in the same building as FOX News. One day Rita Cosby's Blackberry showed up in our office space ... totally separate elevator banks, different floor, different everything. Our best guess was that someone from the cleaning crew grabbed it, got scared, and ditched it, but someone with other motives could do some serious damage in a day where smartphones provide portable access to a massive amount of personal and private information.

a2tech 16y ago

After maybe 30 seconds it automatically returns to the lock screen-in fact I was barely able to get to a contact before it locked again

extension 16y ago
Really? I'm seeing something very different. Not only is it not timing out, but I can't even lock it again manually. Neither the home button nor lock button do anything (except take a photo if I press them both, which I just now discovered). EDIT: I can re-lock it by holding Home to get to voice control, then cancelling that and pressing Home or Lock. EDIT2: It takes a screenshot, not a photo. Damn, photo would be way more useful.
davej 16y ago
When you're on the contacts screen, hold down the power button until the power-off screen comes up, then press cancel. That should stop it from going back to the lock screen.

bsk 16y ago

If you need a secure phone get a Blackberry ;)

sliverstorm 16y ago

Am I the only one who thought "wait, the iPhone only has one button..."

bradfordw 16y ago

up-up, down-down, left-right, left-right, b, a...

tptacek 16y ago

It's actually worse than the article suggests; from the phone app, you can get to Mail and SMS (Share Contact); from SMS, you can get to the phone's camera roll; I'd be surprised if URL expansion didn't get you to Safari via Mail or SMS. On the other hand, it's not like the keypad lock was Fort Knox. I don't even bother with it normally.

chrisbolt 16y ago
Just tried it, tapping URLs, email addresses, and physical addresses in the contact list doesn't do anything for me.
- Xuzz 16y ago
  You can, however, use the "share contact" button to evade that.
DrStalker 16y ago
I bother with the keyboard lock to stop people grabbing my phone and tweeting "HA HA I SUCK BALLS!" before I notice what they're doing. It works really well for this purpose, but I wouldn't trust it to do much more.
jkent 16y ago
I don't agree that it's worse. I think it's mild. Call it a local-only data-exposing exploit. I find it best to keep the phone in my pocket. It also stops people from stealing it - a more common occurrence than hacking contacts.

Xuzz 16y ago

(Note: this is a pretty technical post.) The iPhone's passcode is pretty superficial. Only the UI code actually enforces it, and this is one of the results of that distinction. In fact, when you unlock, you are still viewing the same process as you were before it was unlocked. It just called the "_unlockWithSound" method and set an internal state to unlocked. Edit: as pointed out to me on IRC by comex (author of JailbreakMe), there is lower level protection in the "lockdownd" service, but since the UI controls that, it doesn't really provide any additional security except it blocks iTunes syncing and such). However, with this "hack", you are still locked, so you can't do anything like opening apps (again, the UI process locks opening apps, as part of their "security"). But, I did some experimentation, and here's what I found for impact: - You can read and edit contacts, of course. - I am not sure if phone calls work, but they didn't appear to. - While clicking an email address does nothing, clicking the "send contact" lets you send an email to whoever you want, custom address and all. - You can view all the photos by pressing the "add photo" on a contact you edit. You can also take new ones saved to there. - You can send SMS and MMS using the same method as for email, but selecting MMS. - You /cannot/ enter Safari or go to the homescreen: unless someone finds another similar "hack" to exit the app, as then you could see the icons (but, as the "is locked" flag is still "true", it won't let you launch apps). - FaceTime doesn't seem possible. This is a serious issue, and with the publicity it already has, I would only expect Apple to fix it (with a 4.1.1 firmware release, of course, I don't expect them to care about their iPhone 2G owners back on 3.1.3) within two weeks. However, if they want to fix this, they need to redesign the workings of the lock screen. The current way it works is incredibly simple to circumvent. Finally, on an unrelated note, the same exploits used in the jailbreak tools like "greenpois0n" and "PwnageTool" can be used to get around the passcode and get full filesystem access, or just remove it altogether. But you do need a computer for that, which you don't with this.

jacquesm 16y ago
Does this really qualify as pretty technical ? It's not exactly the guts of Haskell or Clojure or something like that.
- whimsy 16y ago

tyrelb 16y ago

works for me! i wonder how many accidental 911 calls will be made from trying this...

cmelbye 16y ago
None, unless you enter "911" for some reason. If you type "###" it just says "Emergency calls only."

archangel_one 16y ago

This reminds me a little of jwz's comments on xscreensaver + toolkits: http://www.jwz.org/xscreensaver/toolkits.html http://www.jwz.org/xscreensaver/toolkits.html Although, while I don't really mind xscreensaver's unlock screen, I don't think Steve Jobs would give it the thumbs up :)

vidar 16y ago

Locks only keep honest people out.

IgorPartola 16y ago

I don't know about others, but I feel that the iPhone is a terrible phone to use in an emergency. I currently have a 3G which contributes to this, but it takes me at least 30 seconds to go from holding the locked phone (I have no pass code on it) to actually hearing the ring tone. I've had to dial 911 twice on it and it was not a quick experience and since the second time it was for someone who crashed their car head first into a tree right outside of my back yard it was kind of critical that I dial quickly.

kvs 16y ago

Reminded me of Epic Windows 98 Logon: http://i.imgur.com/JPxql.gif http://i.imgur.com/JPxql.gif

wazoox 16y ago

Doesn't work on the 3 jail-broken 3G/GS iPhone I tried (3.2 firmware).

eyeareque 16y ago

I can't seem to replicate it, but one time I was able to get to the home screen by double clicking the home button, switching to a different app, and then pressing home a single time to return to the home screen.