By Binu Paul email: b.paul@mobilenapps.com | Feb 26, 2013 10:08 AM EST
It appears the iOS 6.1 troubles are far from over despite Apple seeding iOS 6.1.3 beta 2 fixing the much-publicized lock screen passcode bypass bug. The passcode bypass vulnerability refuses to vanish from the Apple software with the discovery of a new lock screen bug that allows anyone to access the internal data of the iPhone by simply plugging it into a computer via USB.
Follow us
The second bug of the similar nature to surface this month, the vulnerability was first posted on the Full Disclosure mailing list by Vulnerability Lab CEO Benjamin Kunz Mejri. The bug apparently allows attackers to access users' photos, contacts and more by following a series of steps on an iPhone running iOS 6.1.
The new method starts quite similarly as the one highlighted earlier this month by manipulating the phone's screenshot function, its emergency call function and its power button. The attacker can make an emergency call on the iPhone, cancel it while holding the power on and off to gain temporary access to the device. A video posted on the advisory shows a user browsing through the phone's voicemail list and contacts list while holding down the power button.
"The difference between the first exploit and this one is how it can make the iPhone screen go black, allowing an attacker to plug the device into a computer via USB and access the user's data without having their PIN or passcode credentials," Ars Technica notes.
Check out the video below that explains the bypass method:
Here is an extract from Mejri's advisory:
"The vulnerability is located in the main login module of the mobile iOS device (iPhone or iPad) when processing to use the screenshot function in combination with the emergency call and power (standby) button. The vulnerability allows the local attacker to bypass the code lock in iTunes and via USB when a black screen bug occurs. The vulnerability can be exploited by local attackers with physical device access without privileged iOS account or required user interaction. Successful exploitation of the vulnerability results in unauthorized device access and information disclosure."
However, there are conflicting reports on the potential reach of this vulnerability. Confronting the nature of the bypass bug, The Next Web says it has conducted some tests and uncovered that the bug does not allow access to your iPhone's file system. "It allows you no access to anything, not pictures, not contacts and certainly not the file system," the report said while acknowledging the existence of the vulnerability and its ability to bypass the lock, or to bring you to a blank black screen with just the status bar.
© 2013 Mobile & Apps All rights reserved. Do not reproduce without permission.
ZTE Grand S Release Date In U.S. Put On Hold Until 2014 
Apple Drops Prices On Refurbished iPad Mini, iPad 4 Tablets 
Google Glass Is Creepy, Says Early Glass User 
Nexus 4 Rocking Android 4.3 Version Stars In New Photos, Video 
AT&T Promises Cellular Video Calls, Mobile Video Chat For All Customers 
Tiger Woods 12 and NBA Jam Are The Latest EA Sports Games To Come Exclusive To Nokia Lumia 
