{
	"id": "a7f7f87e-9419-4f0b-8450-a5dfe888e31d",
	"created_at": "2026-04-06T00:09:45.577607Z",
	"updated_at": "2026-04-10T03:24:04.401415Z",
	"deleted_at": null,
	"sha1_hash": "2c6c5e3df7fb3677442ccb3420b6caa1804fbd9d",
	"title": "iOS 10 Passcode Bypass Can Access Photos, Contacts",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 68337,
	"plain_text": "iOS 10 Passcode Bypass Can Access Photos, Contacts\r\nBy Chris Brook\r\nPublished: 2016-11-17 · Archived: 2026-04-05 17:59:25 UTC\r\nA vulnerability in iOS 8, 9, 10, and even the most recent beta version, 10.2 beta 3, could allow an attacker to\r\naccess photos and contacts on a locked iPhone.\r\nA vulnerability in Apple’s iOS versions 8, 9, and 10 could allow an attacker to access photos and contacts on a\r\nlocked iPhone, according to two sources that posted videos showing how the password bypass works. According\r\nto both sources, the vulnerability also impacts the most recent version of iOS 10.2 beta 3.\r\nThe loophole involves tricking Siri and Apple’s accessibility feature in iOS called VoiceOver to sidestep the\r\ndevice’s passcode.\r\nOwners of two different YouTube channels that specialize in Apple jailbreak news, tutorials, and reviews,\r\niDeviceHelp and EverythingApplePro, disclosed the bug in videos posted this week.\r\nLike most iPhone passcode bypasses, the process is a little far flung, but appears to work, provided the attacker\r\nhas physical access to a device that has Siri enabled.\r\n“It doesn’t matter if you have [iOS’ fingerprint recognition feature] Touch ID, a six code, or four code passcode, it\r\nworks on all of them,” Filip, who runs the channel EverythingApplePro says of the bypass, in his video.\r\nTo carry out the bypass, an attacker would also either need the phone number of the device or have to wait until\r\nsomeone calls it. In most instances, assuming a user has linked their phone number with their phone’s ‘contact’\r\ninformation, asking Siri “Who am I?” will display the number.\r\nEtt fel inträffade.\r\nDet går inte att köra JavaScript.\r\nhttps://threatpost.com/ios-10-passcode-bypass-can-access-photos-contacts/122033/\r\nPage 1 of 3\n\nEtt fel inträffade.\r\nDet går inte att köra JavaScript.\r\nAccording to the two videos, a user could follow a series of seven steps to bypass the passcode:\r\nStep 1: Call phone number of device.\r\nStep 2: Device shows message icon – click ‘Message’ and then ‘Custom’ which takes you to the ‘New Message’\r\nscreen.\r\nStep 3: Long press Siri button, say “Turn on Voice Over.”\r\nStep 4: Go back to the message screen, double tap bar where the caller’s name is usually entered. Hold,\r\nimmediately click the keyboard. Repeat until a slide-in effect on the iPhone’s screen above the keyboard appears.\r\nStep 5: Long press Siri to “Turn off VoiceOver,” return to messages and type the first letter of a caller’s name in\r\ntop bar, tap (information) icon next to it, and create a new contact.\r\nStep 6: Select ‘add photo’ and ‘choose photo’. Attacker granted ability to view victim’s photo gallery, despite the\r\niPhone being in a locked state.\r\nStep 7: Select a contact on the iPhone, granted ability to view previous conversations.\r\nTo fix the issue, at least in the short term, users can always disable Siri on their lock screen by going to Settings -\u003e\r\nTouch ID \u0026 Passcode -\u003e Disable Siri on the Lockscreen.\r\nIt’s unclear when or if Apple will fix the issue, which reportedly also affects iPads. The company did not\r\nimmediately return a request for comment on Thursday. Miguel Alvarado, who runs iDeviceHelp, suggested\r\nWednesday however that Apple may fix the issue for 4S users in a future update, iOS 9.3.6:\r\niPhone passcode bypasses have become a common occurrence over the last few years and seem to pop up every\r\ncouple of iOS releases. In March, researchers disclosed how an attacker could use Siri to bypass an iPhone’s\r\npasscode to access native iOS apps like Clock and Event Calendar. That vulnerability affected iOS 9.0, 9.1 and\r\n9.2.1.\r\nAnother bypass surfaced in April that affected iOS 9.3.1. That bypass could have allowed an attacker to bypass\r\nSiri to search Twitter and in turn gain access to photos and contacts on a device.\r\nhttps://threatpost.com/ios-10-passcode-bypass-can-access-photos-contacts/122033/\r\nPage 2 of 3\n\nSource: https://threatpost.com/ios-10-passcode-bypass-can-access-photos-contacts/122033/\r\nhttps://threatpost.com/ios-10-passcode-bypass-can-access-photos-contacts/122033/\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://threatpost.com/ios-10-passcode-bypass-can-access-photos-contacts/122033/"
	],
	"report_names": [
		"122033"
	],
	"threat_actors": [
		{
			"id": "34eea331-d052-4096-ae03-a22f1d090bd4",
			"created_at": "2025-08-07T02:03:25.073494Z",
			"updated_at": "2026-04-10T02:00:03.709243Z",
			"deleted_at": null,
			"main_name": "NICKEL ACADEMY",
			"aliases": [
				"ATK3 ",
				"Black Artemis ",
				"COVELLITE ",
				"CTG-2460 ",
				"Citrine Sleet ",
				"Diamond Sleet ",
				"Guardians of Peace",
				"HIDDEN COBRA ",
				"High Anonymous",
				"Labyrinth Chollima ",
				"Lazarus Group ",
				"NNPT Group",
				"New Romanic Cyber Army Team",
				"Temp.Hermit ",
				"UNC577 ",
				"Who Am I?",
				"Whois Team",
				"ZINC "
			],
			"source_name": "Secureworks:NICKEL ACADEMY",
			"tools": [
				"Destover",
				"KorHigh",
				"Volgmer"
			],
			"source_id": "Secureworks",
			"reports": null
		}
	],
	"ts_created_at": 1775434185,
	"ts_updated_at": 1775791444,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/2c6c5e3df7fb3677442ccb3420b6caa1804fbd9d.pdf",
		"text": "https://archive.orkl.eu/2c6c5e3df7fb3677442ccb3420b6caa1804fbd9d.txt",
		"img": "https://archive.orkl.eu/2c6c5e3df7fb3677442ccb3420b6caa1804fbd9d.jpg"
	}
}