New iOS 7 Security Flaw Lets You Bypass An iPhone's Passcode To Make Calls
September 21, 2013
Already, just a couple of days after the first security bug on iOS 7 was discovered, here comes the second one.
The new bug is demonstrated in a video sent to Forbes by Karam Daoud, a 27-year old resident of the Palestinian city of Ramallah who has worked as a bug tester for a mobile carrier. The video, embedded below, shows how a passcode-protected iPhone running iOS 7 can be operated to make calls.
On iOS 7, unauthorized calls can be made by using the Emergency Call layer of an iPhone's passcode protection feature. Forbes notes:
Anyone who gets physical access to a locked iPhone running iOS 7 can simply tap “Emergency” on the lock screen, which brings up an emergency calling screen. Then he or she can dial any number and rapidly tap the call button until the phone reverts to an empty screen with an Apple logo at the center and make the call to that number, says Daoud. “Once the black screen appeared, it was pretty clear that this is a bug,” says Daoud. “You can dial a number anywhere, any time.”If you can't see the video embedded above, please click here. Indeed, I tested the security flaw accordingly on my iPhone 5, and it enabled me to place a call to any number after tapping the call button a number of times until the iPhone restarts. Daoud says that he has already contacted Apple about the security bug. Apple, in turn, has thanked him for the information and informed him that it would be resolved in a follow-up update to iOS 7. The first iOS 7 security bug also allows an intruder to bypass a passcode-protected iPhone's lock screen. But in that bug's case, the intruder can access the device's Photos app and hijack email and social networking accounts from there. This is possible by opening the Clock app from the Control Center. Unlike the new bug, though, the first iOS 7 security bug has a quick fix: just disable the ability to launch Control Center from the lock screen in the Settings app.
