Hackers Can Use Your iPhone's Contacts App To Fully Control It, Thanks To A Security Hole

Apple isn't doing so hot right now. Last week, their FaceID was hacked by some guys using just tape and glasses, then they caught blowback for forcing people to spend more money to replace their iPhone batteries.

But this time, it's those same phones getting hacked.

According to security firm Check Point, there's a way to hack every iPhone and iPad running iOS 8 right up to betas of the latest iOS 13. That's eight years of Apple devices hackable, with over a billion users affected worldwide.

What Check Point found is that the Contacts app in iOS can be exploited using industry-standard SQLite database. Basically, it uses a simple Contacts search to trick the iPhone into running malicious code that can let a hacker steal your data and passwords.

"SQLite is the most wide-spread database engine in the world," said Check Point. "It is available in every operating system, desktop and mobile phone. Windows 10, macOS, iOS, Chrome, Safari, Firefox and Android are popular users of SQLite."

The thing is, this vulnerability really shouldn't exist. It's apparently just that Apple has been negligent, because it makes use of a bug that was discovered four years ago and hasn't yet been fixed.

"This feature was only ever considered vulnerable in the context of a program that allows arbitrary SQL from an untrusted source and so it was mitigated accordingly," the report reads. "However, SQLite usage is so versatile that we can actually still trigger it in many scenarios."

Basically, it was believed that only an unknown app could trigger the bug in iOS. And since there aren't unknown apps on the App Store (and side-loading on an iPhone isn't advised anyway even if you crack it) it seemed there wasn't really a problem. Except of course that Check Point figured out it could be done using the Contacts app.

Hackers do need access to your unlocked device to exploit this, so you're fine if you keep your phone close at hand. However, it's a completely different story if your phone gets stolen for instance. Additionally, it could just be a matter of time before they figure out how to trigger this bug remotely too.