Copy and paste trick could unlock iOS 10 devices in Lost Mode

Lost and stolen iOS devices could be at risk if ne’er-do-wells learn of this blunt-force method of getting past Activation Lock. No special equipment or technical know-how is required, which means any geek off the streets can do it. Fortunately, it’s easily fixed — but until that happens, you might want to be a little extra careful about leaving your phone unattended.

Apple wasn’t silly enough to allow arbitrary code execution from the fields, so there’s no serious buffer overflow attack here. But if you put enough characters into both fields (upwards of 10,000) the device will slow down and eventually freeze. Put the device to sleep with a cover, wait a few seconds, and open it up — voila, the home screen!

That method worked on 10.1, but with 10.1.1, you have to do a bit of screen rotation and use Night Shift mode. The home screen only shows up for a fraction of a second, but Kunz-Mejri told SecurityWeek that one can get it to stay visible with a well-timed button press.

The problem could be fixed with a simple character limit on those fields, a fix Apple apparently overlooked or didn’t have time to implement in the update.

TechCrunch has contacted Apple for confirmation and further details, and this post will be updated if we hear back.

Posted by Devin Coldewey, Contributor “Tech Crunch