Passcode Bypass Exploit for iOS 12.1 Appears Just After Release
Just a few hours after Apple released iOS 12.1 – which contained a few new features and a large slate of bug fixes – a security researcher identified a new privacy flaw. The researcher, Jose Rodriguez, recently made headlines a few weeks ago after identifying a problem with Siri similar to this new vulnerability. In both cases, an unauthorized user could access restricted information by bypassing a user’s PIN passcode. Though the exploits require physical access to your device to execute, they can result in the exposure of photos (in the case of the Siri exploit) and contact information that would otherwise remain private.
The crux of the issue this time is an apparent security oversight in one of iOS 12.1’s newest features, Group FaceTime. Designed to support group video chats with up to 32 people, Apple wanted it to be easy for users to take advantage of the feature. By adding in a simple feature designed to make growing Group FaceTime chats a faster process, Apple also seems to have inadvertently given thieves a potential way to glean more information from the phone.
If someone wanted to snoop through a target phone they had access to, all they would need to do is to call the phone or use its Siri assistant to make a call. Once it connects, switching the call to FaceTime mode immediately and tapping on the “Add Person” button will allow the user to start exploring the target phone’s contacts. Even if the phone was locked before receiving the call, the contact list becomes available without any additional authentication necessary. Full details on each contact entry are accessible with this exploit.
Ultimately, while exposing contact details is not good, it’s impact is limited by the fact that physical, direct access to the phone is required. The larger problem is the fact that this is yet another in a long line of recent security fumbles on Apple’s part. While professing to work towards being the most secure operating system out there, Apple keeps leaving the side door open and allowing personal information to leak out accidentally. For now, no workaround can prevent this exploit, though disabling Siri can make it harder for a would-be snooper to get in if they do not know your phone number. Since iOS 12.1 just came out, it may be some time yet before a patch appears to close this loophole.
