iOS 7 Vulnerability Lets Attackers Control iPhones With Siri’s Help

Just days after Apple released iOS 7, researchers from web security company Cenzic say they have found a security flaw stemming from Apple’s voice-activated personal assistant Siri, that allows anyone to bypass controls on a locked iPhone and perform a number of actions.

According to Cenzic, security engineers Abhishek Rahirikar and Michael Yuen were able to use Siri to post to Facebook and Twitter, send messages and emails, make calls, and access contact information, all on a locked iPhone.

Rahirikar and Yuen discovered the vulnerability on Thursday.

Some actions that the researchers were able to perform on a locked iPhone include the ability to:

• Call any phone

• Send messages using iPhone owner’s identity

• Send email using iPhone owner’s

• View calling history 

• View limited contacts 

• Discover personal information of contacts with common, easily-guessed names

• Post to Twitter

• Post to Facebook

• Get addresses saved in Apple Maps

Some of these functions were also found to be accessible under certain circumstances on older iPhones, including those running iOS 6.

Rahirikar and Yuen demonstrate the vulnerability in the video below:

“In the wrong hands, your iPhone could lead to compromise of your identity, even when it is locked and protected by a password,” Tyler Rorabaugh, VP of Engineering at Cenzic, wrote in a blog post.

“A patch is sorely needed, not only in iOS7 but in older versions. On a broader scale, Cenzic encourages all enterprises to do careful scanning of all new applications introduced to the organization, particularly mobile applications, which have frequently been found to be vulnerable to attack.”

Cenzic told SecurityWeek that the vulnerability has been reported to Apple.

On Thursday, a separate vulnerability was disclosed by other researchers that allows users to bypass the screen lock feature and access certain functions.