New iOS 13 vulnerability: Even iPhone locked screen can steal user information

Earlier, Apple officially released its new iPhone 11 series devices and iOS 13. Recently, a security personnel discovered a vulnerability in iOS 13, which allows hackers to steal user information even when the iPhone is in lock screen state.

Recently, a security researcher named Jose Rodriguez released a YouTube video and showed the vulnerability he found in the existing iOS 13 system: by making a FaceTime call and then enabling the Siri VoiceOver feature, iPhone users can access the phone owner's contact list. This can provide hackers with personal information including phone numbers, email addresses, street addresses, etc. without unlocking the device. VoiceOver allows Siri to read text displayed on the iPhone display and is considered an accessibility feature for the blind or visually impaired.

Jose Rodriguez said he sent Apple a video showing the vulnerability on July 17, but it still appeared in the iOS 13 Gold Master (GM) version. It is worth noting that Jose Rodriguez also discovered a similar vulnerability on iOS 12.1 last year, which allowed hackers to access not only the phone user's contacts, but also his or her photos. However, Apple subsequently patched this issue in a later update. The newly discovered vulnerability allows hackers to view user contacts and other information in the target iPhone.

Like the vulnerability he discovered last year, the new iOS 13 vulnerability requires the hacker to hold the target's iPhone for a long time to complete the entire information acquisition process. In addition, he also needs a second phone to initiate a FaceTime call with the target iPhone. Apple is expected to patch this vulnerability in iOS 13.1.