Major Security Hole in iPhone Firmware — And How To Fix It
6:46 am, August 27th, 2008, Lonnie Lazar
UPDATE: You can fix the hole by remapping the “Home” button. In the iPhone’s Settings/General/Home Button, assign double clicking the Home button to “Home” — not “Phone Favorites.”
iPhone’s 2.0.2 firmware allows almost full access to your iPhone even when it’s under password protection, according to a report in MacRumors. Access can be gained through the “Emergency Call” keypad that appears on the passcode entry screen, allowing unrestricted use of Safari’s browser as well as access to Mail, SMS, Contacts, Maps and more.
Here’s how it works:
1. On the passcode screen hit “Emergency Call” button at bottom left.
2. In the Emergency Call screen, hit the “Home” button twice. You’ll be taken to the Favorites screen.
3. From there, hit the blue arrow next to a contact’s name.
4. You can now access all the iPhone’s functions by selecting their email address, homepage URL or address.
5. For example — hit the contact’s “Homepage” URL — and you are straight into Safari.
6. Hit the email address, and you enter Mail. Cancel the message, and you have full access to the iPhone’s email.
Via MacRumors
Posted by Lonnie Lazar in Rumors, iPhone | Comment on this article












[...] CultofMac via Macrumors Forums] Categories Filed Under: Apple, Inc., Security, Uh Oh, iPhone Comments [0] [...]
MacBlogz - Your one stop mac news stop » Blog Archive » Major Security Flaw in iPhone Software 2.0.2, on August 27th, 2008 at 7:29 am
[...] Major Security Flaw in 2.0.2. [Mac Rumors via Cult of Mac] [...]
Major iPhone 2.0.2. firmware vulnerability gives total access even on password protected forms. Worse: dead simple. | MostReviews.com, on August 27th, 2008 at 4:26 pm
[...] CultofMac via Macrumors [...]
Violent Comic Book Application Rejected from App Store; Outrage Ensues (Try iPhone Kerio Email Hosting) | InfTek Hosting - Professional Hosted Kerio MailServer, Push Email for iPhone, and cPanel Solutions For SMB, on August 28th, 2008 at 1:08 pm
[...] CultofMac via Macrumors [...]
UK iPhone 3G Ad Banned; ‘Misleading Claims’ to Blame (Try Push Kerio Mail Service for iPhone) | InfTek Hosting - Professional Hosted Kerio MailServer, Push Email for iPhone, and cPanel Solutions For SMB, on August 28th, 2008 at 1:25 pm
Has anybody else noticed that in addition to the lack of security regarding the Home button you can also dial any number from the “Emergency Call Only” part of the menu? I thought you were only supposed to dial 911 from this?! So that basically means not only could somebody have total access to your favorites/email/web/google maps they could also make any phone call they want anywhere!
SkyGuy79, on August 30th, 2008 at 12:23 pm