 |
| Image: IDG |
A number of bypass vulnerabilities could make it possible for an attacker to break the lock screen passcode on your iPad, iPhone running iOS 9.
Vulnerability Lab team has disclosed four ways on how attackers could get pass the screen lock passcode of Apple devices. You need to know that an attacker requires physical access to the gadget to open it, as what has ever reported that the hacks were working smoothly on a number of Apple devices running iOS 9.0, 9.1 and 9.2.1.
As quoted from a popular tech news media a security researcher named Benjamin Kunz Mejri reveals a new way for passing the passcode lock screen on two Apple OS versions. He discovered the details on how the method work successfully on iOS 8 and iOS 9, as it now becomes the flaws for iOS operating systems. You can see the video from Vulnerability Lab that showing the scenarios of new ways about how local attackers bypass the passcode in iOS 9 and get illegal access to Apple devices.
The Vulnerability Lab explained that By using some Apple apps or modules such as Siri, the iOS event callender or the clock module, local attackers can request an internal browser link to the App Store which makes it possible for them to bypass the client’s passcode or fingerprint protection feature. They can abuse the vulnerabilities in App Store.
Each of the attack scenarios practiced and explained in the video starts on an iOS gadget with a locked passcode.
The first attack synopsis shows entering the Home button to run the Siri and and then used it to run a non-existing application. The Siri notifies the user that there is no such app on the device, but the Siri is able look for the all on the App Store. By entering the App Store to open a new secured browser window. It can update or run the last app, or entering Home button to preview the task slide. It also can swipe over the task preview. This screen lock passcode bypass scenario can be done on iPhone 5, 5s, 6 and 6s.
The second attack synopsis is still the same to the first by entering the Siri and then running the clock app. Open the world clock and enter the picture for the Weather Channel LLC; when the weather applivation is not running, a new secured browser slide is going to run anything that provides links to the App Store menu. Tap two times the Home to show the task slide or tap update and enter the last app. Move to the running front screen and voila, then the lock screen passcode got bypassed. This method can be done on iPhone 5, 5s, 6 and 6s.
The third attack synopsys is showing the trick to bypass the passcode on iPad 1 and 2 by doing the same the same as the second synopsis. It will get unauthorized access to the iPad.
The fourth method is by running the Siri by pushing the Home and then command the Siri to Run Calendar app. You could open the link of the Information of Weather Channel that is located at the bottom. In case the app is not active, then a new window opens with the links of the App Store. Enter update and run the last application, or push on the Home button two times to show the task slide. Move over to tap the active front screen and then the passcode is bypassed.
Even though the security team of the Apple was notified on January 4, the timeline of the vulnerability disclosure is not showing the dates for Apple to develop a patch. The alternative solution is by hardening the settings of the device. The Vulnerability Lab gives the tips to do that:
- Deactivate the Siri permanently in the Settings menu.
- Disable the link of Weather Channel LLC by deactivating the Events Calendar.
- Disarm exploitation by deactivating the world clock and timer in the public control panel.
- To avoid the redirect when the weather app is disabled, activate the app settings.
Watch the video how an attcker can bypass passcode lock screen on iPhone and iPad running iOS9.
0 komentar:
Post a Comment