Tuesday, May 28, 2024

Hacker Bypass iPhone Lockscreen to Access the Contact list by Exploit a Bug in iOS 13

A security researcher discovered a flaw in iOS 13 that allows bypassing the iPhone lock screen and access the victims to contact information without unlocking the device.

Apple announced a release of iOS 13 during the company’s iPhone 11 event at its Cupertino, California, headquarters on Tuesday. Meanwhile, Jose Rodrigue, a Spanish security researcher discovered two security flaws (lock screen bypass ) in iOS 13 Beta which is available since June 2019.

He has successfully exploited the iPhone lock screen by activating the FaceTime call and enable access to the contact list with the help of Siri ‘s Voice over feature.

Rodriguez reported the vulnerabilities to Apple on July, 17, But still Apple working in the Gold Master (GM) version of iOS 13, which is scheduled to be released on September 19.

How to Bypass the iPhone Lock Screen to Access the Contact List?

In order to perform the hack, the attacker first needs to physically access the mobile and make a FaceTime call from another Iphone.

Once the targeted iPhone that running with iOS 13 receives the call, the attacker needs to click the option called “custom” and respond with the Text Message.

At this moment, an attacker needs to activate the VoiceOver feature by Interact with Siri to change the “To” field where the attacker can just tap on it and pulls up the contact list that saved in the vulnerable iPhone.

Through the filed, he can access the email addresses, phone numbers, address information and more contacts details.

Rodriguez demonstrates the video, in which he exploits the bug in iOS 13 to access the contacts, and the process is very simple to anyone who has basic skills about the iPhone.

The process of exploiting the bug is difficult since the attacker needs to access the device first, and also the targeted device supports Siri for enabling voice control.

The flaw expected to be fixed in 13.1 that more likey Apple released on September 30.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

DDNS Service In Fortinet Or QNAP Embedded Devices Exposes Sensitive Data, Researchers Warn

Hackers employ DNS for various purposes like redirecting traffic to enable man-in-the-middle attacks, infecting...

PoC Exploit Released For macOS Privilege Escalation Vulnerability

A new vulnerability has been discovered in macOS Sonoma that is associated with privilege...

CatDDoS Exploiting 80+ Vulnerabilities, Attacking 300+ Targets Daily

Malicious traffic floods targeted systems, servers, or networks in Distributed Denial of Service (DDoS)...

GNOME Remote Desktop Vulnerability Let Attackers Read Login Credentials

GNOME desktop manager was equipped with a new feature which allowed remote users to...

Kesakode: A Remote Hash Lookup Service To Identify Malware Samples

Today marks a significant milestone for Malcat users with the release of version 0.9.6,...

Cisco Firepower Vulnerability Let Attackers Launch SQL Injection Attacks

 A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software's web-based...

Hackers Exploit WordPress Plugin to Steal Credit Card Data

Hackers have exploited an obscure WordPress plugin to inject malware into websites, specifically targeting...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles