Method Discovered to Bypass the iPhone Lock Screen on iOS 12

With the release of iOS 12, a new method has been found to bypass the iPhone lock screen and gain access to personal information. This vulnerability allows someone to view the address book and all photos on the device. The flaw was discovered by Jose Rodriguez, the same researcher who previously found similar vulnerabilities (the last time was in iOS 9 in 2016).

As before, the method involves activating Siri from a locked phone, but this time it combines that with the new ability to change settings using voice commands. By enabling VoiceOver (an accessibility feature for visually impaired users that reads aloud information displayed on the screen), Rodriguez managed to make the phone display contacts from the address book and photos from the Camera Roll.

How to View Contact Information

1. If Face ID is enabled, cover the Face ID camera. If Face ID is disabled or the device uses Touch ID, skip this step.
2. Activate Siri by holding the side button on newer devices or the Home button on older ones.
3. Say “enable VoiceOver” to Siri.
4. Press the side button to put the device to sleep.
5. From another phone, call the target iPhone (FaceTime also works).
6. On the incoming call screen, tap the “Message” icon, then double-tap anywhere on the screen.
7. Select “Custom” from the list, then double-tap anywhere on the screen.
8. Tap the “+” icon in the top right corner to select it.
9. From another iPhone, send an iMessage to the target phone.
10. As soon as the message appears on the target phone, double-tap anywhere on the screen to highlight the “+” icon at the bottom.
11. Wait until the screen turns white and the message disappears.
12. Tap the screen once to select an invisible option.
13. Swipe left several times until VoiceOver says “Cancel.”
14. Double-tap anywhere on the screen to select “Cancel.”
15. Tap the button that switches the keyboard to number input mode once, then double-tap anywhere.
16. Tap any digit in the top row of the keyboard once, then double-tap anywhere. Now you can view all contacts that start with that digit. If you use 3D Touch (press firmly), you can see more detailed information about these contacts.

How to View All Contacts and Photos

1. If there is an “info” (i) button next to a contact, tap it once, then double-tap anywhere (if there are no such contacts, this method won’t work).
2. Press and hold the side button (or Home on iPhone 8 and below) to activate Siri.
3. Say “disable VoiceOver” to Siri.
4. Swipe up from the bottom of the screen to exit Siri (on older devices, press Home).
5. Firmly press the contact icon at the top of the contact info page. A menu with options “Call,” “Message,” and “Add to Existing Contact” will appear.
6. Tap “Add to Existing Contact.” Now you can browse all contacts in the address book, not just those starting with a specific digit.
7. Select any contact.
8. Tap the photo icon next to “add photo,” then tap “Choose Photo” in the pop-up window. At this point, you still can’t see any photos.
9. Activate Siri by holding the side button or Home button, if available.
10. Say “enable VoiceOver” to Siri.
11. Slowly swipe up from the bottom of the screen until you feel a vibration, which will exit Siri to the photo selection page (it looks like a contact page). On devices with a Home button, just press it instead.
12. Swipe right several times until the phone says “Camera Roll.”
13. Double-tap anywhere to select the Camera Roll.
14. Tap once on the area where a photo would normally appear.
15. Tap once to select the highlighted photo.
16. Swipe left or right several times until “Choose Photo” is selected.
17. Hold the side button or press Home, if available.
18. Say “disable VoiceOver” to Siri.
19. Swipe up from the bottom of the screen to exit Siri (or press Home if the device has one).
20. Tap the “edit” button where the person’s photo should be, then tap “Edit Photo” in the menu.
21. Now you can view the photo in full resolution, but it will be displayed inside a semi-transparent circle.

Security Note

The number of steps required for this bypass has increased compared to similar vulnerabilities in previous iOS versions. The time needed to perform the entire process has also grown, meaning an attacker would first need to physically possess the phone.

To protect your phone from this vulnerability, simply disable Siri on the lock screen (“Settings → Face/Touch ID & Passcode → Siri”) or at least disable “Reply with Message” (in the same menu). Apple will likely fix this issue in an upcoming system update.