Apple iOS 6.1.3 fixes passcode bypass, but more flaws found

Published April 5, 2013 6:49pm

Apple Inc. has released an update to its iOS operating system for mobile devices to address a security flaw that allows an unauthorized user to bypass passcodes to access data —only to have a researcher find new security holes in the update.

The tech firm acknowledged a team behind a recent jailbreak tool for four of six bugs addressed by the latest iOS version, 6.1.3, tech site The Next Web reported.

"By its very nature, the process of jailbreaking iPhones requires that iOS be flawed. These flaws, sometimes called vulnerabilities or bugs, are used by the jailbreaking teams to open up the system partition of the iPhone and to allow users to install applications outside of the App Store," The Next Web said.

Credited by Apple for the discovery of the four bugs was evad3rs, which created the untethered iOS 6.1 jailbreak earlier this year.

Jailbreaking is a process that allows a user to modify iOS such that it can download and install apps not from the official App Store.

While jailbreaking gives a user more freedom to choose what apps to install, it also carries the risk of malware being installed on the Apple device.

A separate blog post by Sophos' Graham Cluley noted the update is 18.2 MB, and can be downloaded “over-the-air.”

Map updates for Japan

Cluley said iOS 6.1.3 may also include Maps updates for Japan.

"Nevertheless, you have to be grateful that Apple has now fixed this security loophole. At least Apple iPhone and iPad devices are typically running an up-to-date version of their operating system," he said.

Voice dial loophole

But no sooner had it been rolled out than a researcher found other security holes that again left the lock screen vulnerable, security vendor Sophos said.

In a blog post, Sophos said "videosdebarraquito" produced a video showing how to avoid the iOS 6.1.3 passcode lock, "if you have physical access to the device and a widget for removing the SIM card."

"It appears that circumventing the passcode lock can allow an unauthorized party access to the device's photo gallery and use the phone," it said.

But it added this flaw can be prevented since the bypass needs the "Voice Dial" feature, which is disabled on iPhones using Apple's Siri voice recognition feature. — TJD, GMA News

Tags: apple, appleios, cybersecurity