Did You Know?



Reply
JimM
Posts: 2,308
Topics: 299
Kudos: 1,320
Registered: ‎01-19-2012

Interrogating Siri - iOS Lock Screen Defeated

It seems that all the fancy lockscreens in the world still won't protect iOS users from poor, vulnerable Siri.  Shockingly, if a thief steals your iOS device, he's not just getting the device - he's also effectively getting a hostage.  And what do you do with a hostage?  Well, why not interrogate her?  If the thief can't get into the device, maybe the hostage will divulge some useful information without any need to get past the lock screen.  Although Siri is locked down from voice-mail or email access without unlocking the device, there are plenty of other things a malicious user could have her do and plenty of personal information that can be pried out of her.

 

 ioshalp.jpg
image: patch.com

 

Ken Westin at TripWire cites some example questions that Siri is all too happy to answer with a lock screen still in place:

  • What is _____’s phone number?
  • What is _____’s address
  • Where is my next appointment?
  • What is my address?
  • Check my voicemail. (shows who called but requires unlock to listen…whew!)
  • Show my recent calls.
  • Tell ____ ‘You are stupid’
  • Give me directions home
  • Post to Facebook ‘I have been held ransom, please send money’
  • Post to Twitter ‘Send me $50,000 in a brown paper bag’

We tested some of this and found the report to be true.  In fact, Richard was able to have Siri call his mom, from the lock screen, by just saying, "Siri, call mom."  But, it could have been anyone who picked up his phone calling Richard's mom instead.

 

As Ken Westin notes, what you need to do is disable Siri from the lock screen.

The setting for this is General > Passcode Lock (Allow Access When Locked).

Amazingly, this setting is enabled by default, with seemingly no regard to the user's security.  We recommend disabling this setting immediately.

 

Though none of the questions or commands listed here are things you'd want to let just anybody do with your iOS device, "Give me directions home" strikes me as particularly scary.  If a stalker wants to find out where you live, he needs only to gain access to your unattended iOS device and ask Siri.  The moral of the story is, if you're an iOS user with Siri enabled, be sure to disable her on the lock screen!

/// JimM ///
/// Former Community Manager - Now Humble Internet Citizen///
/// Also Formerly a Technical Support Escalations Engineer ///
Please use plain text.
Moderator
Richard
Posts: 169
Registered: ‎12-05-2012

Re: Interrogating Siri - iOS Lock Screen Defeated

Remember people, check your settings. I have already fixed it on my phone.
--Richard Melick--
Marketing Outreach Specialist

Webroot ThreatBlog
Stay updated with unique security news and follow me on Twitter
Please use plain text.
pegas
Posts: 1,677
Topics: 71
Kudos: 756
Ideas: 17
Registered: ‎02-23-2012

Re: Interrogating Siri - iOS Lock Screen Defeated

Many Thanks Jim for the article. It's very interesting read.

 

As for myself I have disabled Siri on my 4S completely because Siri doesn't support my native language and she is hmmm ... how to say politely ... she is quite confused from my english pronouncements. :smileyvery-happy: So I made her life easier and disabled her. :smileyhappy:

Sr. Expert Advisor

Please use plain text.
New Member
MrMarcosMiranda
Posts: 2
Registered: ‎10-26-2013

Re: Interrogating Siri - iOS Lock Screen Defeated

Great article and points. The problem is the solution doesn't apply to my iPhone 5S (iOS 7). Does anybody know how to disable Siri in iOS7? It seems this option is unavailable after most recent update (7.0.3).
Please use plain text.
New Member
whaler54
Posts: 1
Registered: ‎10-26-2013

Re: Interrogating Siri - iOS Lock Screen Defeated

Can I assume this does not apply to Android OS ?

Please use plain text.
DavidP1970
Posts: 3,232
Kudos: 1,651
Registered: ‎10-28-2012

Re: Interrogating Siri - iOS Lock Screen Defeated

Hello whaler54 and welcome to the Webroot Community!

 

Yes, you assume correctly.  This bug will NOT affect Android OS.  Siri is a part of Apple's iOS mobile operating system and is not found in Google's Android OS.  

 

@whaler54 



      

New to the Community? Register now and start posting!



Helpful Webroot Links:


Download (PC)   Download (Best Buy Subscription)   Submit Trouble Ticket   Account Console   User Guides   



"If you don't learn something new every day, you need to pay more attention. I often get my daily learning here so grab a chair and stay a while!"
WSA-Complete (Beta Tester), Toshiba Satellite L305, Intel Pentium Dual CPU at 1.87 GHz, 3 GB RAM With Windows 7 (x86) (Yes its old.. but it still usually works! : )
Please use plain text.
New Member
latvia123
Posts: 1
Registered: ‎10-26-2013

Re: Interrogating Siri - iOS Lock Screen Defeated

Hi,

Thank you for this helpful article. I tried interrogating Siri and it worked just like you said it would.

She called my mom with the lock screen on.

So I went in and disabled her in the lock screen mode.

I also shared this link with my friends who have iPhones.

 

Priceless!

Thanks again.

Please use plain text.
DavidP1970
Posts: 3,232
Kudos: 1,651
Registered: ‎10-28-2012

Re: Interrogating Siri - iOS Lock Screen Defeated

Hello Latvia123 and welcome to the Webroot Community!

 

Glad you found this interesting!  Stick around as this is a great place to learn not just about Webroot, but about a lot of other tech/security related items as well!



      

New to the Community? Register now and start posting!



Helpful Webroot Links:


Download (PC)   Download (Best Buy Subscription)   Submit Trouble Ticket   Account Console   User Guides   



"If you don't learn something new every day, you need to pay more attention. I often get my daily learning here so grab a chair and stay a while!"
WSA-Complete (Beta Tester), Toshiba Satellite L305, Intel Pentium Dual CPU at 1.87 GHz, 3 GB RAM With Windows 7 (x86) (Yes its old.. but it still usually works! : )
Please use plain text.
Community Guide
TonyW
Posts: 179
Registered: ‎03-26-2012

Re: Interrogating Siri - iOS Lock Screen Defeated


MrMarcosMiranda wrote:
Does anybody know how to disable Siri in iOS7?

To disable Siri completely in iOS 7, go to Settings > General > Siri. When you're there, you can toggle Siri on or off.

 

Hope that helps.

Please use plain text.
New Member
MrMarcosMiranda
Posts: 2
Registered: ‎10-26-2013

Re: Interrogating Siri - iOS Lock Screen Defeated

For iOS 7 it's actually:
• Settings
• General
• Touch Id/Pass code
• Allow access when locked (Siri off)
Please use plain text.