AI agents building security tests – architecture and prompts
The Detectify AI Agent Alfred fully automates the creation of security tests for new vulnerabilities, from research to a merge request. In its first six …
In our previous post we covered a bug released yesterday where anyone can break into a phone that is using iOS7. However, we have discovered that this does in fact not prevent a similar bug from exploiting the lock screen.
The new way is based on the fact that Voice Control/Siri can make phone calls to known contacts, and by using the shutdown screen while calling, the double tap trick can still be done.
We also wrote about some additional ways to trigger the bug, but all versions could be prevented by shutting off the Control Center on Lock Screen. So that’s what we, and everyone else suggested.
However, we have discovered that this does in fact not prevent a similar bug from exploiting the lock screen. The new way is based on the fact that Voice Control/Siri can make phone calls to known contacts, and by using the shutdown screen while calling, the double tap trick can still be done.
And here’s the aftermath: https://twitter.com/avlidienbrunn/status/381099165213683712
Currently we have no suggested patch/fix for this issue.
Check out more content
Account hijacking using “dirty dancing” in sign-in OAuth-flows
Combining response-type switching, invalid state and redirect-uri quirks using OAuth, with third-party javascript-inclusions has multiple vulnerable scenarios where authorization codes or tokens could leak to …
