Flaw In iOS 7 Lets Attackers Take Control Of Users' iPhones
SIRI vulnerability enables attackers to act on user's behalf -- even when iPhone is locked
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
A security flaw in Apple's iOS 7 operating system could enable unauthorized users to send messages or make social network postings on an iPhone owner's behalf -- even when the phone is locked, researchers reported Friday.
The vulnerability, which was disclosed Friday by researchers at application security vendor Cenzic, enables an attacker or prankster to use the SIRI personal voice assistant to crack a locked iPhone and execute tasks that would normally require user permission, such as sending email or posting to Facebook.
In a blog describing the iPhone flaw, the Cenzic researchers said they were able to use a locked iPhone belonging to a third party to send email and texts, make calls, access contact information, and make updates to Facebook and Twitter, all with the user's accounts and without the user's knowledge.
"Imagine someone stealing your iPhone and -- without knowing your passcode – sending messages, email, or social network postings to your friends and contacts, posing as you," the blog says.
The researchers posted a YouTube video demonstrating the ability to use SIRI on a third party's locked iPhone to make an update on the third party's Facebook page. They also reported the ability to collect and steal the personal information of contacts stored in the iPhone.
The flaw also works on some tasks under iOS 6, the researchers say. End users should take care not to let others use their iPhones, and may want to consider disabling SIRI until Apple fixes the problem, the blog states.
Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024