I have long recommended that all iPhone owners enable the passcode lock feature. That way, if someone gets unauthorized access to your iPhone, that person cannot use the iPhone without your secret code. At least, that is how it is supposed to work.
Unfortunately, a few days ago, a poster on a MacRumors forum described a security flaw that allows anyone to get limited access to your phone even if the passcode lock is enabled. When you swipe to unlock an iPhone and then see the "Enter Passcode" screen you can tap the Emergency Call button to make an emergency call. (That way, anyone can use your phone to dial 911.) But instead, enter any other number (or you can even enter ###), tap the green phone button, and then immediately — right as the phone starts to dial — press the lock button on the top of the iPhone. You will then jump into the Phone app on the iPhone, which means that you can view the call history on the phone, use the phone to call anyone that you want, look at (and even modify) the Phone favorites, etc.
And it doesn't stop there. You can also select a contact, tap "Share Contact," and send an e-mail from the iPhone. You can also tap on the blue arrow next to any recent call, tap "Share Contact," choose MMS, tap the phone icon, tap Choose Existing, and then see all of the photos stored on the iPhone. And as Ross Miller of Engadget notes, you can also "hold down the menu button to access voice control and play some locally-stored tunes while you're at it." Thus, this security flaw exposes your phone, your contacts, your photographs, and the ability to send an e-mail from your phone. Lovely.
You can try this out on your own iPhone to see how it works, as long as you are running iOS 4. Apparently the flaw doesn't exist in iOS 3. When you are done, it can be a little tricky to get things back to normal, but one solution I found is to dial any phone number, and then hang up. That will get you back to the "Enter Passcode" screen.
I always question whether I should mention security flaws here because the last thing that I want to do is help "bad guys" figure out how to cause mischief. But this one has already gotten a lot of publicity over the last few days, so at this point I just want to make sure that iPhone owners know about it so that they can be extra careful with their iPhones until a fix comes out. John Gruber of Daring Fireball notes that it appears to already be fixed in the latest beta version of iOS 4.2, which comes out in November, but for the next few days or weeks, this may be something that we have to live with.
[UPDATE: Sure enough, iOS 4.2 will be the solution. Brian Chen of Wired got Apple to respond on the record on this issue, and an Apple spokeman said: "We’re aware of this issue and we will deliver a fix to customers as part of the iOS 4.2 software update in November."]
