Easy way to bypass passcode lock screens on iPhones, iPads running iOS 10

The vulnerability allowing anyone to bypass the passcode lock screen still exists in iOS 10.3.2 and the 10.3.3 beta

Update for iOS 10.3.2

Apple still has not patched the hole allowing you to bypass the iPhone lock screen. As of iOS 10.3.2 (and the 10.3.3 beta), you can still trick Siri into getting into a person’s iPhone.

It works like this:

Press the home button using a finger not associated with your fingerprint authentication, prompting Siri to wake up.
Say to Siri: Cellular data.
Siri will then open the cellular data settings where you can turn off cellular data.

Anyone can do this—it doesn’t have to be the person who “trained” Siri.

By also turning off Wi-Fi, you cut off her connectivity access. You will get an error saying, “Siri not available. You are not connected to the internet.” But you don’t care about that error because you have already bypassed the iPhone lock screen.

Not only can someone trick Siri to turn off cellular data, but they can trick her to read unread text messages and post to Facebook—a major privacy issue.

To do it, again prompt Siri to wake up using a finger not associated with the phone's authentication. Then say, “Read messages,” and Siri will read any unread text messages from the lock screen. Or say, “Post to Facebook,” and Siri will ask you what you want to post to Facebook.

We tested this with a staffer’s iPhone 7, with someone other than the iPhone owner giving the commands. Siri let the person right in.

While we wait for Apple to patch the hole, your best option is to disable Siri from the lock screen.

---

iOS 9 lock screen bypass vulnerability

There are multiple bypass vulnerabilities which could allow an attacker to get past the passcode lock screen on Apple devices running iOS 9.

The details for four different attack scenarios were disclosed by Vulnerability Lab. It’s important to note that an attacker would need physical access to the device to pull this off; that being said, the advisory says the hacks were successfully executed on iPhone models 5, 5s, 6 and 6s as well as iPad models Mini, 1 and 2 running iOS 9 versions 9.0, 9.1 and 9.2.1.

Security researcher Benjamin Kunz Mejri, who disclosed a different method for disabling the passcode lock screen on iOS 8 and iOS 9 about a month ago, discovered the flaws. Vulnerability Lab posted a proof-of-concept video showing multiple new ways for a local attacker to bypass the passcode in iOS 9 and gain unauthorized access to the device.

“Local attackers can use Siri, the event calendar or the available clock module for an internal browser link request to the App Store that is able to bypass the customer’s passcode or fingerprint protection mechanism,” the disclosure states. The attacks exploit vulnerabilities “in App Store, Buy more Tones or Weather Channel links of the clock, event calendar and Siri user interface.”

There are four attack scenarios explained in the disclosure and demonstrated in the proof-of-concept video; each begins on an iOS device with a locked passcode.

The first scenario involves pushing the Home button to activate Siri and asking her to open a non-existing app. Siri responds that you have no such app, but she “can help you look for it on the App Store.” Tapping on the App Store button opens a “a new restricted browser window.” Either select update and open the last app, or “push twice on the Home button” for the task slide preview to appear. Swipe over to the active front screen task and that bypassed the passcode lock screen on iPhone models 5, 5s, 6 and 6s.

The second scenario is similar, first pushing on the Home button for two seconds to activate Siri and then asking to open the clock app. Switch to world clock in the bottom module and tap the image for the Weather Channel LLC network; if the weather app is deactivated by default, then a new restricted browser window will open which has App Store menu links. Click update and open the last app, or tap twice on the Home button to get to task slide preview. Swipe over to the active front screen and voila – passcode lock screen bypassed again; this reportedly works on iPhone models 5, 5s, 6 and 6s.