Apple’s new iPhone update has a bad security flaw

By Benjamin SnyderManaging Editor
Benjamin SnyderManaging Editor

Benjamin Snyder is Fortune's managing editor, leading operations for the newsroom.

Prior to rejoining Fortune, he was a managing editor at Business Insider and has worked as an editor for Bloomberg, LinkedIn and CNBC, covering leadership stories, sports business, careers and business news. He started his career as a breaking news reporter at Fortune in 2014.

A new ad-blocking feature is set to come to iOS 9, setting up a confrontation between Apple and Google.
A new ad-blocking feature is set to come to iOS 9, setting up a confrontation between Apple and Google.
Photograph by Justin Sullivan—Getty Images

There’s a video purporting to show that users can hack into an iPhone with Apple’s new iOS 9 update, allowing people to access a person’s contacts and photos.

AppleInsider reported that Jose Rodriguez, a man who found a security flaw in iOS 6.1.3 two years ago, discovered this error as well. Additionally, the report said that tests were conducted with the iOS 9.01 update and the iOS 9.1 beta, but the fix hasn’t been made yet, according to the AppleInsider. The Telegraph has reported that the newest update has made the fix.

The issue comes when a person types into an iPhone at the unlock screen, but then quickly activates Siri. When that happens, the lock screen appears to be bypassed and the individual has free reign into the person’s phone.

Per the publication:

It should be noted that only devices protected by simple four- or six-digit passcodes are vulnerable to attack, while those with long alphanumeric passwords remain unaffected.

According to the Telegraph:

You can do this by entering an incorrect passcode a few times, and then on the final attempt invoke Siri immediately. Ask it for the time, and use the clock app to type in a random word in the “Choose the City” field and share it.

In order to avoid the error, users can disable Siri access when on the lock screen by going to settings and making the change there. Users can also create an alphanumeric passcode to avoid the issue.

Check out the video, which has over 100,000 views, here: