If you’ve haven’t had your fill of Apple’s security issues in recent weeks, Siri is now the latest to join the slew of problems with the most recent version of iOS (7.1.1).
The newest bug, discovered by Sherif Hashim, allows anyone to easily bypass passcode security measures (unless you have Touch ID enabled) to access the device’s contact list, where they can then pull phone numbers to either call, email, or message. All of this is done with just a few voice commands to Siri.
How It’s Intended to Work
To start, I’ll show you what Siri replies back when I ask her to “view contacts” on my passcode-protected iPhone.
As is standard, Siri asks me to unlock my iPhone first by entering the passcode, before I can access my contacts.
Exploiting the Security Flaw
In order to exploit the security flaw in Siri, rather than asking to view contacts, simply say “call”. Even without having entered my passcode, the command shows up. Now just tap on it to edit, and enter a couple of letters of a common first or last name, then press Done. As you can you, I used “Ne”.
Note:I had to use two letters to reveal the exploit, but the original video shows that it can work with one.
If there are multiple contacts starting with the letters you entered, you will receive a list of names that you can choose from. If only one name shows up, it will place a phone call to that person, so you’ll have to try another combination of letters.
Accessing the Contact List
Tap on Other… to see all of the contacts on the iPhone, ready for you to go through and select. Once you have names and phone numbers, you can use Siri to call, email, or message them directly.
While the use for this is limited to prank calling people on your friend’s or family’s phones, it just goes to show that Apple should spend more time with security issues and improving what they have, rather than spending so much time adding new features to iOS.
How to Protect Yourself
We’ve had passcode exploits in the past (in iOS 7.0.2), but they’re usually patched rather quickly. In the meantime, you can disable Siri from the lock screen by going to Settings -> Passcode and toggling off Siri.
For now, this is just another is a growing list of things that Apple should patch up in the next update.
Just updated your iPhone? You’ll find new emoji, enhanced security, podcast transcripts, Apple Cash virtual numbers, and other useful features. There are even new additions hidden within Safari. Find out what’s new and changed on your iPhone with the iOS 17.4 update.
“Hey there, just a heads-up: We’re part of the Amazon affiliate program, so when you buy through links on our site, we may earn a small commission. But don’t worry, it doesn’t cost you anything extra and helps us keep the lights on. Thanks for your support!”
