Expert disclosed a new passcode bypass to access photos and contacts on a locked iPhone
17.10.2018 securityaffairs Apple

iOS passionate Jose Rodriguez disclosed a new passcode bypass bug that could be to access photos and contacts on a locked iPhone XS.
The security passionate Jose Rodriguez has discovered a new passcode bypass bug that could be exploited on the recently released iOS 12.0.1.

A few weeks ago, Rodriguez discovered a passcode bypass vulnerability in Apple’s new iOS version 12 that could have been exploited to access photos, contacts on a locked iPhone XS.

Now the expert discovered a similar flaw that is very easy to execute by a physical attacker to access photo album of a locked device. The bug allows the attacker to select photos and send them to anyone using Apple Messages.

The new passcode bypass attack works on all current iPhone models, including iPhone X and XS devices, running the latest version of iOS 12 to 12.0.1 version.

The new hack devised by Rodriguez leverage Siri assistant and VoiceOver screen reader to bypass the passcode.

Below the step-by-step procedure for the passcode bypass discovered by Rodriguez:

Call the target phone from any other phone.
Instead of answering the call, click on “Message” in the call window.
Select “Custom” to reply via text message. That will open the Messages input screen.
Invoke Siri to activate VoiceOver, the iOS feature that helps sight-impaired users use an iPhone.
Click on the camera icon.
Invoke Siri with the iPhone’s home button while you double-tap the display. The screen will turn black. This is where the bug kicks in and iOS gets confused.
From here, click on the home button again while the screen remains black.
Swipe up to the upper left corner while the screen remains black. VoiceOver will tell you what you have selected.
Keep swiping to the top left corner until VoiceOver tells you that you can select the Photo Library (“Fototeca” in Rodriguez’ video).
Tap to select Photo Library.
After selecting the Photo Library, iOS will take you back to the message screen, but you’ll see a blank space where the keyboard should be. The blank space is actually an invisible Photo Library.
Click on the shelf handle on top of the blank space to activate the Photo Library.
Now you only have to swipe and double tap to start grabbing photos. Each photo will be pasted in your input field, ready to be sent to any number.
Waiting for a patch it is possible to mitigate the issue by disabling Siri from the lockscreen (Go to the Settings → Face ID & Passcode (Touch ID & Passcode on iPhones with Touch ID) and Disable Siri toggle under “Allow access when locked).