Skip to main content

New iPhone Passcode Bypass Found Hours After Apple Releases iOS 12.1

http://redsecurium.org/
It's only been a few hours since Apple releases iOS 12.1 and an iPhone enthusiast has managed to find a passcode bypass hack, once again, that could allow anyone to see all contacts' private information on a locked iPhone.

Jose Rodriguez, a Spanish security researcher, contacted The Hacker News and confirmed that he discovered an iPhone passcode bypass bug in the latest version of its iOS mobile operating system, iOS 12.1, released by Apple today.

To demonstrate the bug, Rodriguez shared a video with The Hacker News, as shown below, describing how the new iPhone hack works, which is relatively simple to perform than his previous passcode bypass findings.

Instead, the issue resides in a new feature, called Group FaceTime, introduced by Apple with iOS 12.1, which makes it easy for users to video chat with more people than ever before—maximum 32 people.

How Does the New iPhone Passcode Bypass Attack Work?


Unlike his previous passcode bypass hacks, the new method works even without having Siri or VoiceOver screen reader feature enabled on a target iPhone, and is trivial to execute.
Here are steps to execute the new passcode bypass hack:
"In a passcode-locked iPhone with latest iOS released today Tuesday, you receive a phone call, or you ask Siri make a phone call (can be digit by digit), and, by changing the call to FaceTime you can access to the contact list while adding more people to the Group FaceTime, and by doing 3D Touch on each contact you can see more contact information," Rodriguez told The Hacker News.
Also, it should be noted that since the attack utilizes Apple's Facetime, the hack would only work if the devices involved in the process are iPhones.

The new passcode bypass method seems to work on all current iPhone models, including iPhone X and XS devices, running the latest version of the Apple mobile operating system, i.e., iOS 12.1.

Since there's no workaround to temporarily fix the issue, users can just wait for Apple to issue a software update to address the new iPhone passcode bypass bug as soon as possible.

Rodriguez has previously discovered a series of iPhone passcode bypass hacks. Around two weeks ago, he found an iPhone bypass hack that works in 12.0.1 and takes advantage of Siri and VoiceOver screen reader to get through your phone's defenses, allowing attackers to access photos and contacts on a locked iPhone.

Rodriguez discovered a similar bug in iOS 12 in late last month that also takes advantage of Siri and VoiceOver screen reader, and allows attackers with physical access to your iPhone to access your contacts and photos.

Have something to say about this article? Comment below or share it with us on Facebook, Twitter or our LinkedIn Group.
Labels:

Comments

Post a Comment

Popular posts from this blog

Information Security Analyst Interview Questions

Top 12 Information Security Analyst Interview Questions & Answers 1) Explain what is the role of information security analyst? From small to large companies role of information security analyst includes Implementing security measures to protect computer systems, data and networks Keep himself up-to-date with on the latest intelligence which includes hackers techniques as well Preventing data loss and service interruptions Testing of data processing system and performing risk assessments Installing various security software like firewalls, data encryption and other security measures Recommending security enhancements and purchases Planning, testing and implementing network disaster plans Staff training on information and network security procedures 2) Mention what is data leakage? What are the factors that can cause data leakage? The separation or departing of IP from its intended place of storage is known as data leakage.  The factors that are respons...
Post a Comment
Read more

Community Health Systems agrees to pay nearly $3.1 million as a part of settlement for 2014 data breach

The settlement covers a total of 4.5 million patients impacted in the breach. The cyber attack took place in April and June of 2014 and was orchestrated by a Chinese criminal group. Tennessee-based Community Health Systems has reached a settlement over a 2014 data breach that 4.5 million patients. A proposed amount of $3.1 million has been reached as a part of the settlement in a class action lawsuit filed against the healthcare. What happened? According to court records, the cyber attack took place in April and June of 2014 and was orchestrated by a Chinese criminal group, that solely focused on obtaining intellectual data. The hackers used an advanced malware and exfiltrated a variety of information such as patient names, Social Security numbers, addresses, dates of birth, and phone numbers. However, no credit card details and medical details were affected in the breach. Following the breach, the healthcare firm had notified the patients about the breach. However, the...
Post a Comment
Read more
Phishing Campaigns Targeting Google and Yahoo Accounts To Bypassing Two-Factor Authentication Several phishing campaigns targeting hundreds of individuals across the Middle East and North Africa. The attacker targers HRDs, journalists, political actors. Amnesty International published a report on multiple campaigns that traget self-described “secure email” services, such as Tutanota and ProtonMail and another campaign that aimed in bypassing two-factor authentication. Crafted Phishing Sites – Secure Email Providers The phishing campaign primarily targeted popular secure email service providers such as Tutanota and ProtonMail. Threat actors used a well-crafted phishing page – by obtaining the domain tutanota[.]org, whereas the original domain of the service provider is tutanota[.]com. A phishing attack is one of the dangerous social engineering attacks that leads to capture a victim’s username and password that will get store it to an attacker machine and reuse it l...
Post a Comment
Read more