Apple iOS 12.1 Security Exploit Allows Attackers Bypass Lockscreen
Apple recently began pushing out a new update to its mobile operating system, iOS version 12.1, and unfortunately it comes with a bug that allows an attacker to access an iPhone's full contact information without ever having to enter a passcode. It's a rather simple exploit that doesn't require any programming experience.
All it does require is physical access to the phone that is being targeted. The exploit is rather simple—an attacker just needs to initiate a phone call and then switch to FaceTime as soon as it connects. From there, they can go to the bottom of the screen and select "Add Person," then press the plus (+) icon to view the full list of contacts. Using 3D Touch reveals more information on each contact.
It's an incredibly simple and disappointing oversight on Apple's part. Here is a video of the exploit in action...
"In a passcode-locked iPhone with latest iOS 12.1.
You receive a phone call, or you ask Siri make a phone call (can be digit by digit), and, by changing the call to FaceTime you can access to the contacts list and by doing 3D Touch on each contact you can see more contact information, and doing tap on the contact phone number, allows start a new phone call," security researcher Jose Rodriguez explains.
The exploit seems to work on all current iPhone models, including the newest iPhone XS series, so long as they are running iOS 12.1. If you own an iPhone and have already updated, there is no workaround available at the moment, other than making sure nobody else comes in possession of your iPhone. That's the bad news.
The good news is it probably won't be long before Apple issues a security update to fix this flaw. It's received quite a bit of media attention, so we don't imagine Apple will let this go unfixed for very long. We'll have to wait and see. In the meantime, if you're worried about someone accessing your phone's contact information, keep your phone more guarded than you normally would.
Thumbnail/Top Image Source: YouTube via videosdebarraquito
