{"id":240,"date":"2008-09-09T12:38:18","date_gmt":"2008-09-09T07:38:18","guid":{"rendered":"http:\/\/www.logichub.net\/blog\/?p=240"},"modified":"2008-09-11T08:51:43","modified_gmt":"2008-09-11T03:51:43","slug":"apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password","status":"publish","type":"post","link":"https:\/\/www.logichub.net\/blog\/2008\/09\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\/","title":{"rendered":"Apple iPhone Password Locking Bug Lets Physically Local Users Bypass the Password"},"content":{"rendered":"

Apple iPhone 2.0.2, in some configurations, allows physically proximate attackers to bypass intended access restrictions, and obtain sensitive information or make arbitrary use of the device, via an Emergency Call tap and a Home double-tap, followed by a tap of any contact’s blue arrow.<\/p>\n

Details:<\/h3>\n

SecurityTracker Alert ID:<\/strong> 1020763<\/p>\n

SecurityTracker URL:<\/strong> http:\/\/securitytracker.com\/id?1020763<\/a><\/p>\n

CVE Reference:<\/strong> CVE-2008-3876<\/a><\/p>\n

Updated:<\/strong> Sep 3 2008<\/p>\n

Original Entry Date:<\/strong> Aug 27 2008<\/p>\n

Impact:<\/strong> User access via local system<\/a><\/p>\n

Exploit Included:<\/strong> Yes<\/p>\n

Version(s):<\/strong> 2.0.2<\/p>\n

Impact:<\/strong> A physically local user can bypass the password locking feature to obtain information from the device.
\nSolution:<\/strong> No solution was available at the time of this entry.
\nVendor URL:<\/strong> http:\/\/www.apple.com<\/a>
\nCause:<\/strong> Access control error<\/p>\n

Description:<\/strong> A vulnerability was reported in Apple iPhone. A physically local user can bypass the password locking feature to obtain information from the device. Ver 2.0.2 gives almost full access to the iPhone even while under password protection…<\/p>\n

Steps to Reproduce<\/strong><\/p>\n

    \n
  1. Set iPhone to use passcode lock, have contacts marked as Favorites with links, phone numbers, addresses, etc in address book entry.<\/li>\n
  2. Tap “Emergency Call” keypad from passcode entry screen.<\/li>\n
  3. Double-tap home button.<\/li>\n
  4. Tap blue arrow next to contact’s name.<\/li>\n<\/ol>\n

    You now have full access to applications such as Safari, complete Contacts list, SMS, Maps, “full” Phone access, and Mail by accessing various entries on the Favorite’s page, i.e. tapping their home page brings up a full, unrestricted Safari.<\/p>\n

    UPDATE:<\/strong><\/p>\n

    It is reported that this activity can also be performed on iPhone 2.0.1.<\/p>\n

    Source<\/a> <\/a><\/p>\n

    Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    Apple iPhone 2.0.2, in some configurations, allows physically proximate attackers to bypass intended access restrictions, and obtain sensitive information or make arbitrary use of the device, via an Emergency Call tap and a Home double-tap, followed by a tap of any contact’s blue arrow. Details: SecurityTracker Alert ID: 1020763 SecurityTracker URL: http:\/\/securitytracker.com\/id?1020763 CVE Reference: CVE-2008-3876 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[97,8,65,21,22],"tags":[156,157,159,158],"class_list":["post-240","post","type-post","status-publish","format-standard","hentry","category-iphone","category-it-news","category-mobile","category-security","category-vulnerabilities","tag-apple-iphone","tag-bypass-the-password","tag-iphone-bug","tag-unlocking-without-password"],"yoast_head":"\nApple iPhone Password Locking Bug Lets Physically Local Users Bypass the Password to Access the Device<\/title>\n<meta name=\"description\" content=\"A vulnerability was reported in Apple iPhone 2.0.2. A physically local user can bypass the password locking feature to obtain information from the device.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.logichub.net\/blog\/2008\/09\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Apple iPhone Password Locking Bug Lets Physically Local Users Bypass the Password to Access the Device\" \/>\n<meta property=\"og:description\" content=\"A vulnerability was reported in Apple iPhone 2.0.2. A physically local user can bypass the password locking feature to obtain information from the device.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.logichub.net\/blog\/2008\/09\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\/\" \/>\n<meta property=\"og:site_name\" content=\"for everyone... :)\" \/>\n<meta property=\"article:published_time\" content=\"2008-09-09T07:38:18+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2008-09-11T03:51:43+00:00\" \/>\n<meta name=\"author\" content=\"Kashif\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kashif\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/2008\\\/09\\\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/2008\\\/09\\\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\\\/\"},\"author\":{\"name\":\"Kashif\",\"@id\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/#\\\/schema\\\/person\\\/a8c02ebbadea5c972ff6f29ca61461a2\"},\"headline\":\"Apple iPhone Password Locking Bug Lets Physically Local Users Bypass the Password\",\"datePublished\":\"2008-09-09T07:38:18+00:00\",\"dateModified\":\"2008-09-11T03:51:43+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/2008\\\/09\\\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\\\/\"},\"wordCount\":261,\"commentCount\":0,\"keywords\":[\"Apple iPhone\",\"Bypass the password\",\"iPhone bug\",\"Unlocking without password\"],\"articleSection\":[\"iPhone\",\"IT News\",\"Mobile\",\"Security\",\"Vulnerabilities\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.logichub.net\\\/blog\\\/2008\\\/09\\\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/2008\\\/09\\\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\\\/\",\"url\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/2008\\\/09\\\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\\\/\",\"name\":\"Apple iPhone Password Locking Bug Lets Physically Local Users Bypass the Password to Access the Device\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/#website\"},\"datePublished\":\"2008-09-09T07:38:18+00:00\",\"dateModified\":\"2008-09-11T03:51:43+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/#\\\/schema\\\/person\\\/a8c02ebbadea5c972ff6f29ca61461a2\"},\"description\":\"A vulnerability was reported in Apple iPhone 2.0.2. A physically local user can bypass the password locking feature to obtain information from the device.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/2008\\\/09\\\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.logichub.net\\\/blog\\\/2008\\\/09\\\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/2008\\\/09\\\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Apple iPhone Password Locking Bug Lets Physically Local Users Bypass the Password\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/\",\"name\":\"for everyone... :)\",\"description\":\"etc...\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/#\\\/schema\\\/person\\\/a8c02ebbadea5c972ff6f29ca61461a2\",\"name\":\"Kashif\",\"sameAs\":[\"http:\\\/\\\/www.logichub.net\\\/blog\\\/\"],\"url\":\"https:\\\/\\\/www.logichub.net\\\/blog\\\/author\\\/admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Apple iPhone Password Locking Bug Lets Physically Local Users Bypass the Password to Access the Device","description":"A vulnerability was reported in Apple iPhone 2.0.2. A physically local user can bypass the password locking feature to obtain information from the device.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.logichub.net\/blog\/2008\/09\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\/","og_locale":"en_US","og_type":"article","og_title":"Apple iPhone Password Locking Bug Lets Physically Local Users Bypass the Password to Access the Device","og_description":"A vulnerability was reported in Apple iPhone 2.0.2. A physically local user can bypass the password locking feature to obtain information from the device.","og_url":"https:\/\/www.logichub.net\/blog\/2008\/09\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\/","og_site_name":"for everyone... :)","article_published_time":"2008-09-09T07:38:18+00:00","article_modified_time":"2008-09-11T03:51:43+00:00","author":"Kashif","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Kashif","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.logichub.net\/blog\/2008\/09\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\/#article","isPartOf":{"@id":"https:\/\/www.logichub.net\/blog\/2008\/09\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\/"},"author":{"name":"Kashif","@id":"https:\/\/www.logichub.net\/blog\/#\/schema\/person\/a8c02ebbadea5c972ff6f29ca61461a2"},"headline":"Apple iPhone Password Locking Bug Lets Physically Local Users Bypass the Password","datePublished":"2008-09-09T07:38:18+00:00","dateModified":"2008-09-11T03:51:43+00:00","mainEntityOfPage":{"@id":"https:\/\/www.logichub.net\/blog\/2008\/09\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\/"},"wordCount":261,"commentCount":0,"keywords":["Apple iPhone","Bypass the password","iPhone bug","Unlocking without password"],"articleSection":["iPhone","IT News","Mobile","Security","Vulnerabilities"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.logichub.net\/blog\/2008\/09\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.logichub.net\/blog\/2008\/09\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\/","url":"https:\/\/www.logichub.net\/blog\/2008\/09\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\/","name":"Apple iPhone Password Locking Bug Lets Physically Local Users Bypass the Password to Access the Device","isPartOf":{"@id":"https:\/\/www.logichub.net\/blog\/#website"},"datePublished":"2008-09-09T07:38:18+00:00","dateModified":"2008-09-11T03:51:43+00:00","author":{"@id":"https:\/\/www.logichub.net\/blog\/#\/schema\/person\/a8c02ebbadea5c972ff6f29ca61461a2"},"description":"A vulnerability was reported in Apple iPhone 2.0.2. A physically local user can bypass the password locking feature to obtain information from the device.","breadcrumb":{"@id":"https:\/\/www.logichub.net\/blog\/2008\/09\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.logichub.net\/blog\/2008\/09\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.logichub.net\/blog\/2008\/09\/apple-iphone-password-locking-bug-lets-physically-local-users-bypass-the-password\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.logichub.net\/blog\/"},{"@type":"ListItem","position":2,"name":"Apple iPhone Password Locking Bug Lets Physically Local Users Bypass the Password"}]},{"@type":"WebSite","@id":"https:\/\/www.logichub.net\/blog\/#website","url":"https:\/\/www.logichub.net\/blog\/","name":"for everyone... :)","description":"etc...","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.logichub.net\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.logichub.net\/blog\/#\/schema\/person\/a8c02ebbadea5c972ff6f29ca61461a2","name":"Kashif","sameAs":["http:\/\/www.logichub.net\/blog\/"],"url":"https:\/\/www.logichub.net\/blog\/author\/admin\/"}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack-related-posts":[{"id":207,"url":"https:\/\/www.logichub.net\/blog\/2008\/09\/iphone-doubles-web-browser-share\/","url_meta":{"origin":240,"position":0},"title":"iPhone Doubles Web Browser Share","author":"Kashif","date":"September 2, 2008","format":false,"excerpt":"The rollout of the iPhone 3G has seen a large increase in the iPhone's global Web share, according to figures released Monday. The figures, collected by Web analytics company Net Applications, show that in June 2008, before the launch of the iPhone 3G, the iPhone had 0.16 percent share of\u2026","rel":"","context":"In "Browser"","block_context":{"text":"Browser","link":"https:\/\/www.logichub.net\/blog\/category\/software\/browser-software\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":502,"url":"https:\/\/www.logichub.net\/blog\/2011\/01\/easy-to-implement-techniques-on-how-to-secure-your-home-pc-from-bad-guys\/","url_meta":{"origin":240,"position":1},"title":"Easy to implement techniques on How to Secure your Home PC from Bad Guys","author":"Kashif","date":"January 13, 2011","format":false,"excerpt":"The\u00a0Internet\u00a0may\u00a0contain dangers\u00a0for the\u00a0ordinary and innocent computer user.\u00a0Without\u00a0proper security measures, your PC and data saved in your PC is\u00a0in\u00a0danger\u00a0every moment of\u00a0your\u00a0system is\u00a0connected\u00a0to the internet. In order to protect your Home PC, these steps are necessary to follow: Use of Strong Password Use of reliable Antivirus and\u00a0Anti Spyware\u00a0software Update your Operating System\u2026","rel":"","context":"In "IT Articles"","block_context":{"text":"IT Articles","link":"https:\/\/www.logichub.net\/blog\/category\/articles\/it-articles\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":125,"url":"https:\/\/www.logichub.net\/blog\/2008\/08\/hacker-claims-java-bug-affects-millions-of-phones\/","url_meta":{"origin":240,"position":2},"title":"Hacker Claims Java Bug Affects Millions of Phones","author":"Kashif","date":"August 20, 2008","format":false,"excerpt":"A Polish hacker and self professed security expert claims to have discovered vulnerabilities in the mobile Java technology implemented by Nokia in its mid-range S40 devices, potentially putting millions of handsets at risk. Adam Gowdiak, who is in the process of setting up a security research firm, Security Explorations, claims\u2026","rel":"","context":"In "Hacking"","block_context":{"text":"Hacking","link":"https:\/\/www.logichub.net\/blog\/category\/security\/hacking\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":115,"url":"https:\/\/www.logichub.net\/blog\/2008\/08\/sun-opens-java-tools-in-mobile-fight-back\/","url_meta":{"origin":240,"position":3},"title":"Sun Opens Java Tools in Mobile Fight Back","author":"Kashif","date":"August 20, 2008","format":false,"excerpt":"Sun Microsystems has open sourced its Java toolkit for building mobile applications just as the role Java plays on handsets comes into question. The company has released the Light-Weight UI Toolkit (LWUIT) (https:\/\/lwuit.dev.java.net\/) under a GPLv2 license with a classpath exception - for binary linking with an application - as\u2026","rel":"","context":"In "IT News"","block_context":{"text":"IT News","link":"https:\/\/www.logichub.net\/blog\/category\/news\/it-news\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":168,"url":"https:\/\/www.logichub.net\/blog\/2008\/08\/sixth-taste-discovered-calcium\/","url_meta":{"origin":240,"position":4},"title":"Sixth ‘Taste’ Discovered – Calcium","author":"Kashif","date":"August 22, 2008","format":false,"excerpt":"Here's the new taste sensation \u2014 your tongue might be able to taste calcium. The capability to taste calcium has now been discovered in mice. With these rodents and humans sharing many of the same genes, the new finding suggests that people might also have such a taste. The four\u2026","rel":"","context":"In "Medical"","block_context":{"text":"Medical","link":"https:\/\/www.logichub.net\/blog\/category\/science\/medical\/"},"img":{"alt_text":"Section of a rat tongue stained for the Calcium-Sensing Receptor (CaSR)","src":"https:\/\/i0.wp.com\/www.logichub.net\/blog\/wp-content\/uploads\/2008\/08\/080822-color-calcium-01.jpg?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":202,"url":"https:\/\/www.logichub.net\/blog\/2008\/09\/google-takes-aim-at-microsoft-with-new-web-browser\/","url_meta":{"origin":240,"position":5},"title":"Google Takes Aim at Microsoft with new Web Browser","author":"Kashif","date":"September 2, 2008","format":false,"excerpt":"SAN FRANCISCO - Google Inc. is releasing its own Web browser in a long-anticipated move aimed at countering the dominance of Microsoft Corp.'s Internet Explorer and ensuring easy access to its market-leading search engine. The Mountain View-based company took the unusual step of announcing its latest product on the Labor\u2026","rel":"","context":"In "Browser"","block_context":{"text":"Browser","link":"https:\/\/www.logichub.net\/blog\/category\/software\/browser-software\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/www.logichub.net\/blog\/wp-json\/wp\/v2\/posts\/240","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.logichub.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.logichub.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.logichub.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.logichub.net\/blog\/wp-json\/wp\/v2\/comments?post=240"}],"version-history":[{"count":0,"href":"https:\/\/www.logichub.net\/blog\/wp-json\/wp\/v2\/posts\/240\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.logichub.net\/blog\/wp-json\/wp\/v2\/media?parent=240"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.logichub.net\/blog\/wp-json\/wp\/v2\/categories?post=240"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.logichub.net\/blog\/wp-json\/wp\/v2\/tags?post=240"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}