The Curious Case of the iOS 9.3.1 “Hey, Siri” Contacts, Photos Vulnerability

Late last night, my father of all people, tipped me off to a story making the rounds on the Internet about a security vulnerability with an iPhone 6s or iPhone 6s Plus running iOS 9.3.1.  The reported vulnerability allowed a malicious user to by-pass the iPhone’s lock screen using the hands free “Hey, Siri” command.  When successfully executed, an attacker would be able to see all of the contacts and photos on the device.

Quartz has an article up on their site that starts off with:

“You might want to wait before downloading the latest version of Apple’s operating system for iPhones.

If you own an iPhone 6S or 6S Plus and have upgraded to iOS 9.3.1, other people can access your contacts and photos without entering a passcode to unlock the phone. It’s an elaborate and finicky but nonetheless startling loophole.”

With my iPhone 6s Plus unlocked and running iOS 9.3.1, the “finicky” exploit worked.  However, if I repeated the process with my iPhone locked, the attack was stopped dead in it’s tracks.

This morning I tried to reproduce the attack, I received a notice from Siri that I needed to unlock my iPhone first.  I made this short video that was posted to YouTube this afternoon.

[youtube https://www.youtube.com/watch?v=O_BrmKI3W9Y]

Oddly, the security settings that AppleInsider.com reported as needing to be turned off to prevent the attack were still enabled on my iPhone.  Curious.

So what happened?

This afternoon, Fortune.com has an article up that the Siri-related problem was corrected by Apple from Apple HQ.

“While initial reports and claims from the bug’s discoverers said that the issue was an iOS 9 glitch, it turns out it was a Siri problem. On Tuesday morning, after seeing the rash of reports on the issue, Apple issued an update to Siri fixing the problem. Therefore, users who were previously subject to the issue are now safe and do not require a software update to get the fix.”

Security and privacy conscious iPhone 6s and iPhone 6s Plus users can go back to their day without further worry.

Mophie Announces Juice Pack Cases for Apple iPhone 6, iPhone 6 Plus

Today, on the second day of the Consumer Electronics Show (CES), Mophie has announced the new Juice Pack Air and Juice Pack Plus.

Orange County, Calif., (January 6, 2015) – mophie—the #1 selling mobile battery case in North America(1), and innovator of power and storage solutions for mobile devices—announced today its lineup of protective battery cases for iPhone® 6 and iPhone® 6 Plus. Introducing the juice pack air® for iPhone® 6 (more than 100% extra battery), juice pack plus® for iPhone® 6 (more than 120% extra battery), and juice pack® for iPhone® 6 Plus (more than 60% extra battery).

Users get up to 17 more hours of talk time, up to 12 more hours of web browsing, up to 13 more hours of video playback, and up to 60 more hours of music playback.

“Our journey to bring the juice pack to consumers for every generation of iPhone continues with our latest solutions for iPhone 6 and iPhone 6 Plus,” said Daniel Huang, mophie CEO and Co-Founder. “Since release of the original juice pack for the first iPhone, mophie battery cases have become a necessity to legions of smartphone users. Because we understand how vital these solutions are, our team remains intensely focused on quality and the level of innovative design needed to drive the direction of this industry.”

I’ve been a fan of the Mophie Juice Pack series of batteries since I picked up an iPhone 4S.  The Mophie cases add a lot of utility to your iPhone by adding a spare battery and doing double duty as a durable, handsome looking iPhone case that doesn’t add a lot of bulk.  I’ve been on many an overnight and long weekend trips with my kids and the Juice Pack has kept me charged up and connected to family back home and other team leaders on the trip.

Any serious iPhone user really needs to have one of these cases.  If you have more than one iDevice that you need to keep charged – say an iPhone 6 and an iPad Air, then I would highly recommend one of Mophie’s PowerStation “universal” batteries.

The new Juice Pack cases for the Apple iPhone 6 and iPhone 6 Plus are expected to begin shipping in about three to four weeks.  You can pre-order your Juice Pack now with prices starting at $99.95 for the iPhone 6 and for the iPhone 6 Plus.

The full press release is available on the Mophie website.