Security vulnerability in iOS 5 Lockscreen

Can't duplicate on an iPhone 4.

I just tried it 10 times on my 4S and it never worked for me.

In any case, you can tell Apple here:

http://www.apple.com/feedback/

I can't reproduce this. Do you have "Require Passcode" set to "Immediately?"

Set Require Passcode to Immediately and see if you still have the problem.

Axel_87 wrote:

Hello Community,

I found out a serious security-vulnerability in iOS 5. You can unlock the iPhone without having to enter a passcode by using the camera-shortcut in the lockscreen. Here´s the way to reproduce the problem:

1. Make sure the iPhone is secured with an password/passcode and is locked
2. Doubletap the homebutton and use the camera-shortcut
3. Swipe to the right to bring up the recently taken photos
4. Press the homebutton
5. You now should be taken directly to the homescreen without having to enter the passcode

I can`t repreoduce the problem every time I try it, but it works in about 6/10 cases. I´m using the iPhone 4S w. iOS5

I hope you`ll read this and report it to apple.

Axel

Tried it. Doesn't work. You may want to do a hard reset to see if something is not right. Tried both immediate and 1 minute. No success.

So I can duplicate this using the settings you're using: Require passcode 15 minutes, auto-lock 5. Although I don't think auto-lock has anything to do with it.

If you're requiring the passcode not be active until 15 minutes have passed, then anytime before that 15 minutes, I think you'll be able to follow the steps you outlined and get into the phone. Isn't that right? I'd say that's not a bug but design.

Or is my logic off somewhere?

When I set require passcode to Immediate, it doesn't work and my phone remains locked.

I don't think your logic is off. That's why I asked the question 🙂

I can't reproduce this on my 3GS. Tried it with passcode required immediately and after 1 hour. Double-tapping the Home button and tapping the Camera shortcut gets me to the Camera, alright, but tapping the Camera Roll button brings up the "Your iPhone is locked" screen. This, I believe, is how it should work.

I had this issue but it seems to work like this for me.

I have passcode required set to 1 minute. If I let it lock with time inactive the above procedure still sees the phone ask for a passcode and therefore seems secure but....

if I lock the phone manually with the power button and wake it via the home button or power button it will be at the lock screen asking for me to slide to unlock or offering the camera, as we know. If I slide to unlock it requires the passcode. If, however, I don't slide to unlock but open the camera and then hit home (as discussed above) the phone opens with NO passcode.

I do see this as a bug as the phone seems to be passcode locked but isn't. Passcode times are always going to be a compromise between security and convenience I find 1 minute a reasonable compromise.

Hope this helps

Axel - I have exactly the same problem - thanks for querying it, the immediate lock setting has sorted the issue perfectly!

Erm.....if you have a delay on your passcode then your phone isn't locked during the period of the delay! Simple!

The camera shortcut has nothing to do with it - you can just slide to unlock with the same result. If it's a concern go to Settings-General-Passcode Lock and set Require Passcode to Immediately.

I'm afraid you've missed the point rather...

No...don't think so. There's no bug and no security vulnerability. It works like it's supposed to.

Well I think the useful comments here have finished.