Siri Security Bug Grants Attackers Access to Contacts & Photos on Locked iPhones

[Exterminator]

Content source

http://news.softpedia.com/news/siri-security-bug-grants-attackers-access-to-contacts-photos-on-locked-iphones-502596.shtml

After iOS 9.3.1 was released to fix an annoying activation lock bug in iOS 9.3, it appears that this latest version of Apple's mobile operating system is also plagued by another flaw that affects the user's privacy.

The bug affects iPhone 6s & iPhone 6s Plus models running iOS 9.3.1 and can be exploited via Siri. Attackers can bypass an iPhone's lock screen using a Siri search and access the user's contacts list and private photos.

The security bug is similar to an issue that Apple fixed in September
Jose Rodrigues discovered this issue and made a proof-of-concept video, embedded below. Rodrigues also found a similar problem in iOS 9 last September, when he learned that he could also use Siri to access a phone owner's contact list and photos by asking Siri what the time was.

In his most recent exploit, Rodrigues found that by telling Siri to search on Twitter for various terms, when encountering an email address, he could access menu options allowing him to add the address to an existing contact, without being asked for a password in advance.

From there, he could also choose to add or update the contact's photo, accessing the phone's photo gallery.

Mitigation against the bug's exploitation exists
The trick also works with phone numbers embedded in tweets or any other actionable Contacts data that allows the user to interact with the tweet via 3D Touch actions on a locked iPhone.

The easiest way to mitigate this issue is to disable Siri's lock screen access. iPhone users can do this by going to Settings -> Touch ID & Passcode. Here they'll have to disable the "Allow access when locked" setting.

If you'd like to use Siri for other things when the phone is locked, you can optionally go to Settings -> Twitter and Settings -> Privacy -> Photos and cut off Siri's access to these apps.

 

[Ink]

Apple have fixed the Siri bug, without needing a software update.

An Apple spokeswoman confirmed that the bug was fixed Tuesday morning. Most consumers should have a fix in place -- without the need for a software update.

Source: Apple has fixed a bug that let anyone look at your photos and contacts by using Siri