light bulb

Did You Know?



Reply
Highlighted
Posts: 2,308
Topics: 292
Kudos: 1,371
Registered: ‎01-19-2012

Interrogating Siri - iOS Lock Screen Defeated

It seems that all the fancy lockscreens in the world still won't protect iOS users from poor, vulnerable Siri.  Shockingly, if a thief steals your iOS device, he's not just getting the device - he's also effectively getting a hostage.  And what do you do with a hostage?  Well, why not interrogate her?  If the thief can't get into the device, maybe the hostage will divulge some useful information without any need to get past the lock screen.  Although Siri is locked down from voice-mail or email access without unlocking the device, there are plenty of other things a malicious user could have her do and plenty of personal information that can be pried out of her.

 

 ioshalp.jpg
image: patch.com

 

Ken Westin at TripWire cites some example questions that Siri is all too happy to answer with a lock screen still in place:

  • What is _____’s phone number?
  • What is _____’s address
  • Where is my next appointment?
  • What is my address?
  • Check my voicemail. (shows who called but requires unlock to listen…whew!)
  • Show my recent calls.
  • Tell ____ ‘You are stupid’
  • Give me directions home
  • Post to Facebook ‘I have been held ransom, please send money’
  • Post to Twitter ‘Send me $50,000 in a brown paper bag’

We tested some of this and found the report to be true.  In fact, Richard was able to have Siri call his mom, from the lock screen, by just saying, "Siri, call mom."  But, it could have been anyone who picked up his phone calling Richard's mom instead.

 

As Ken Westin notes, what you need to do is disable Siri from the lock screen.

The setting for this is General > Passcode Lock (Allow Access When Locked).

Amazingly, this setting is enabled by default, with seemingly no regard to the user's security.  We recommend disabling this setting immediately.

 

Though none of the questions or commands listed here are things you'd want to let just anybody do with your iOS device, "Give me directions home" strikes me as particularly scary.  If a stalker wants to find out where you live, he needs only to gain access to your unattended iOS device and ask Siri.  The moral of the story is, if you're an iOS user with Siri enabled, be sure to disable her on the lock screen!

/// JimM ///
/// Former Community Manager - Now Humble Internet Citizen///
/// Also Formerly a Technical Support Escalations Engineer ///
Moderator
Posts: 224
Registered: ‎12-05-2012

Re: Interrogating Siri - iOS Lock Screen Defeated

Remember people, check your settings. I have already fixed it on my phone.
--Richard Melick--
Marketing Outreach Specialist

Webroot ThreatBlog
Stay updated with unique security news and follow me on Twitter
Posts: 1,677
Topics: 71
Kudos: 767
Ideas: 17
Registered: ‎02-23-2012

Re: Interrogating Siri - iOS Lock Screen Defeated

Many Thanks Jim for the article. It's very interesting read.

 

As for myself I have disabled Siri on my 4S completely because Siri doesn't support my native language and she is hmmm ... how to say politely ... she is quite confused from my english pronouncements. Smiley Very Happy So I made her life easier and disabled her. Smiley Happy

Sr. Expert Advisor

New Member
Posts: 2
Registered: ‎10-26-2013

Re: Interrogating Siri - iOS Lock Screen Defeated

Great article and points. The problem is the solution doesn't apply to my iPhone 5S (iOS 7). Does anybody know how to disable Siri in iOS7? It seems this option is unavailable after most recent update (7.0.3).
New Member
Posts: 1
Registered: ‎10-26-2013

Re: Interrogating Siri - iOS Lock Screen Defeated

Can I assume this does not apply to Android OS ?

Posts: 5,959
Kudos: 4,999
Registered: ‎10-28-2012

Re: Interrogating Siri - iOS Lock Screen Defeated

Hello whaler54 and welcome to the Webroot Community!

 

Yes, you assume correctly.  This bug will NOT affect Android OS.  Siri is a part of Apple's iOS mobile operating system and is not found in Google's Android OS.  

 

@whaler54 


David

         

New to the Community? Register now and start posting!



Helpful Webroot Links:


Download (PC)   Download (Best Buy Subscription)   Submit Trouble Ticket   Account Console   User Guides   



"If you don't learn something new every day, you need to pay more attention. I often get my daily learning here so grab a chair and stay a while!"

WSA-Complete (Beta PC), WSA Mobile (Android), WSA Business Mobile (Android) WSA-Endpoint (PC- Some of the time.....)
New Member
Posts: 2
Registered: ‎10-26-2013

Re: Interrogating Siri - iOS Lock Screen Defeated

Hi,

Thank you for this helpful article. I tried interrogating Siri and it worked just like you said it would.

She called my mom with the lock screen on.

So I went in and disabled her in the lock screen mode.

I also shared this link with my friends who have iPhones.

 

Priceless!

Thanks again.

Posts: 5,959
Kudos: 4,999
Registered: ‎10-28-2012

Re: Interrogating Siri - iOS Lock Screen Defeated

Hello Latvia123 and welcome to the Webroot Community!

 

Glad you found this interesting!  Stick around as this is a great place to learn not just about Webroot, but about a lot of other tech/security related items as well!


David

         

New to the Community? Register now and start posting!



Helpful Webroot Links:


Download (PC)   Download (Best Buy Subscription)   Submit Trouble Ticket   Account Console   User Guides   



"If you don't learn something new every day, you need to pay more attention. I often get my daily learning here so grab a chair and stay a while!"

WSA-Complete (Beta PC), WSA Mobile (Android), WSA Business Mobile (Android) WSA-Endpoint (PC- Some of the time.....)
Community Guide
Posts: 179
Registered: ‎03-26-2012

Re: Interrogating Siri - iOS Lock Screen Defeated


MrMarcosMiranda wrote:
Does anybody know how to disable Siri in iOS7?

To disable Siri completely in iOS 7, go to Settings > General > Siri. When you're there, you can toggle Siri on or off.

 

Hope that helps.

New Member
Posts: 2
Registered: ‎10-26-2013

Re: Interrogating Siri - iOS Lock Screen Defeated

For iOS 7 it's actually:
• Settings
• General
• Touch Id/Pass code
• Allow access when locked (Siri off)