iOS Bug Allows Hackers to Break Apple’s iPhone and iPad Activation Lock


Researchers have discovered a new vulnerability in iOS that can be used to bypass Apple's Activation Lock feature. The vulnerability allows hackers to gain access to the home screen without having to enter a passcode.

Apple describes Activation Lock as a feature that's designed to prevent anyone else from using your iOS device if it's lost or stolen. When you turn on Find My iPhone feature, Apple enables Activation Lock automatically on your device. This feature makes it very hard for someone who doesn't own an iPhone or an iPad to wipe it and set it up as a new device.

But, we have seen a few vulnerabilities that enable hackers to bypass Apple's offered protections. At least two variations of this vulnerability have been discovered, one of them on iOS 10.1 and another on the latest iOS 10.1.1.

Researchers bypass iOS 10 Activation Lock

Hemanth Joseph, a security researcher, exploited a weakness in the device setup process, testing the vulnerability on a locked iPad. When he was asked to choose a WiFi network, he selected the Other Network option, where a user is asked to enter the complete name of the network and its key.

The problem appears when a very long string is entered in those fields and the device fails to process it, causing it to freeze. Once he figured out how to get the device stuck during the process, he now needed to get to the home screen. Joseph found that with some practice and the help from the magnetic catch in Apple's Smart Cover, he could bypass the Activation Lock and get to the home screen.

Apple reportedly fixed this problem with iOS 10.1.1.

However, researchers at the Vulnerability Lab found out that they could still reproduce it on the latest iOS 10.1.1, using the device's screen rotation feature and its Night Shift mode. The security firm released a PoC video, which momentarily shows the home screen. Founder Benjamin Kunz-Mejri confirmed they could maintain the access by quickly pressing the power button.

Apple hasn't yet commented on the issue, but is expected to fix the problem in an upcoming iOS update.