Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

11/18/2015
05:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Siris Lockscreen Bypass A Growing Privacy Issue For iOS Users

In less than 30 seconds, anyone with access to an Apple iPhone or iPad can extract a lot of personal data using Siri, Trend Micro says.

Security vendor Trend Micro has sounded the alarm once again on a continuing issue with Apple’s Siri digital assistant that lets anyone with physical access to an iOS device to interact with it and easily extract data even if the device is locked.

In a blog post today, security researchers from the company said it takes just 30 seconds for someone to extract names, phone numbers, and calendar entries -- or even post to a connected social media account -- from a locked iOS device using simple voice commands.

“A locked device should not disclose the owner’s identity and contact information, as well those of the owner’s friends, family, and contacts,” the researchers wrote. “Siri bypasses this and provides detailed information and other functions on a locked mobile device.”

The Trend Micro blog lists several voice commands that someone could use to extract data from iOS devices to which they have physical access. For example, by simply asking, “what’s my name” or “what’s my email address,” an attacker could get the device to disclose the owners’ first and last name and email address.

Similarly, to make a call, post a Facebook status update on the device owner’s account or to carry out any task that the legitimate owner would be able to do, an individual only has to verbalize the appropriate commands.

Though a passcode is supposed to prevent strangers from accessing a locked iOS device, Siri offers a way around it and provides attackers with the same access that the device owner would have, the researchers wrote.

This is by far not the first time that someone has shown how to exploit a locked iOS device using Siri. As the researchers themselves have noted in their blog, discussions on this topic have been going on since Siri was first introduced. 

So far at least, the company has not taken any measures to ensure that Siri cannot be exploited to bypass a locked device. Instead its response has been to recommend that users concerned about the issue simply disable Siri on the lockscreen, Trend Micro says.

The goal in bringing up the issue now is to remind iPhone and iPad users that more and more vectors are available to attackers for breaching Apple’s walled garden these days, says Tom Kellermann, chief cybersecurity officer at Trend Micro.

One example is recent research from French Network and Information Security Agency-ANSSI showing how Siri and other digital assistants like Google Now can be remotely controlled using electromagnetic waves. In a research paper, the ANSSI researchers described how someone using a cheap radio transmitter could issue commands to Siri and Google Now from up to 18 feet away.

 “What the blog highlights is another amazing feature of the iOS ecosystem that can be turned against the user,” Kellermann says. “It is an ecosystem that has been the most secure and many believe it to be impenetrable. That has dramatically changed.”

In order to better protect personal information, Apple should consider implementing voice identity recognition or require some form of user authentication when someone attempts to use Siri to make calls, send texts post to Facebook, or carry out similar commands from a locked phone, Trend Micro says.

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
kaysharbortechnology
50%
50%
kaysharbortechnology,
User Rank: Apprentice
8/31/2016 | 12:08:54 PM
Tushar Jain @ Kays Harbor Technologies
The write up has been framed properly about the security threat that IOS users are facing due to the Siri lockscreen Bypass. To know about the details of the threat, one must give a read.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
11/25/2015 | 11:17:37 PM
Silly
There really does need to be a better balance here.  on the one hand, I don't want to have to unlock my device to use the voice assistant every time I want to make a phone call or do a basic search.  On the other hand, "What's my name?" or "What's my email address?" on a locked device should yield no information without first having to unlock it.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
11/25/2015 | 11:47:16 AM
Re: Voice Recognition or High Degree of Siri Granularity
If there were more options you could decide to not have any restrictions if you wanted...but for those who would choose to keep some information restricted that would be there as well. It's an option that would benefit both sides.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
11/24/2015 | 11:56:29 AM
Re: Apple is correct
Another thing I just wanted to point out, I am wondering when we will start feeling more comfortable about our PII. Most are already available in Google with our picture attached, I wonder what would Siri tell us that others not already knowing? :--))

 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
11/24/2015 | 11:53:35 AM
Re: Voice Recognition or High Degree of Siri Granularity
 I agree mainly but I do not want Siri having restriction on information she could provide.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
11/24/2015 | 11:52:12 AM
Re: Voice Recognition or High Degree of Siri Granularity
Agree, at the same time voice recognition could easily be compromised. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
11/24/2015 | 11:50:50 AM
Re: Apple is correct
Agree, one other option would be a two factor authentication on Siri, so you have a key fob in your hand unless it is in closed proximity Siri on lock screen does not work.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
11/24/2015 | 11:47:57 AM
Disable Siri on Lock Screen
Why is this not a reasonable solution? If you want it accessed by lock screen that simply means it is exposed to outside world. Unless there is real voice recognition which always work there is no alternative and that is not even secure. If you want to put a chip in your body so Siri can recognize you that is possible, that is not what I want tough. :--))
slivingston
50%
50%
slivingston,
User Rank: Apprentice
11/23/2015 | 9:59:08 AM
Re: Apple is correct
That is exactly what I thought. It is just like in business, you have to evaluate the risk and provide security accordingly. You are not going to have the same security on a Yugo as you would a Bugati.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
11/19/2015 | 2:04:12 PM
Voice Recognition or High Degree of Siri Granularity
I think voice recognition software would be helpful not only to security but would most likely improve the functionality of Siri. But I think the cost behind that may be extensive. I think an easier option that may be more secure would be to add more granularity to Siri's Options in Settings. You could restrict what Siri has access to and by doing that you could ensure that certain data elements remain private. Currently the options for Siri are scarce.
Page 1 / 2   >   >>
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11619
PUBLISHED: 2020-04-07
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
CVE-2020-11620
PUBLISHED: 2020-04-07
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
CVE-2020-11509
PUBLISHED: 2020-04-07
An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript via the c37_wpl_import_template admin-post action (which will execute in an administrator's browser if the template is used to create a page).
CVE-2020-6647
PUBLISHED: 2020-04-07
An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack (XSS) via the name parameter.
CVE-2020-9286
PUBLISHED: 2020-04-07
An improper authorization vulnerability in FortiADC may allow a remote authenticated user with low privileges to perform certain actions such as rebooting the system.