Apple’s iOS 7.1 Update Can’t Come Too Soon, Because The Bugs Are Piling Up

Three out of every four iOS users are running iOS 7, but Apple’s redesigned mobile operating system still has its fair share of issues—and fixes for many of them may still be a month away.

At first, there was the lock screen bypass exploit. Then came the iMessage bug. The “screen of death.” Battery issues galore. Now there’s a new vulnerability that allows someone who grabs your phone to quickly disable Apple’s “Find My iPhone” service, which securely tracks the location of all registered iOS and Mac devices. That would effectively hide the device from iCloud’s protective service.

After that, this hypothetical bad guy could also to switch the phone to another iCloud account, gaining the ability to remotely install apps and to siphon some data off the device.

Normally, the iPhone requires a password if you want to deactivate “Find My iPhone.” Now, however, hackers have demonstrated that they can bypass that security step without having to guess, steal or even bypass your Apple ID password.

In the iPhone’s iCloud account settings, in the field where you’d normally enter your Apple ID password to sign in, enter gibberish instead and save. The phone will give you an error noting the incorrect password. Then back out, reopen the same settings page and delete whatever is written in the iCloud account’s “Description” field. Save those settings and you’ll notice Find My iPhone is now toggled off. If you visit iCloud.com or use “Find My iPhone” on another device, you’ll see that Apple can no longer find the original phone.

It’s then possible to de-link the phone from your iCloud account and instead associate it with another one.

The video below, uploaded by YouTube user Bradley Williams, shows iOS 7 users how to pull off the Find My iPhone exploit for themselves:

True, this vulnerability probably doesn’t pose a major threat to most iPhone or iPad users. It requires physical access to the device, and then only works if the user hasn’t set a passcode or enabled the iPhone 5S fingerprint-based Touch ID system. The exploit also doesn’t deactivate Apple’s Activation Lock system, which blocks a thief from erasing and re-activating a stolen phone unless they enter your Apple ID and password.

The exploit is, however, embarrassingly simple. Developers running the beta version of iOS 7.1 say it blocks this exploit and others. But until Apple releases the public version of iOS 7.1, passcodes and/or Touch ID are the best way to protect your iDevices.

Apple has reportedly been working on iOS 7.1 since September. In addition to bug fixes, users should also expect a few visual improvements to specific applications and the overall UI, more natural-sounding Siri voices in more languages, an improved calendar, additional accessibility options, and more.

Apple earlier this week released the fifth beta of iOS 7.1 to developers, but a report from 9to5Mac, citing “reliable sources,” says Apple won’t release iOS 7.1 until March. BGR was the first to report the March release date for iOS 7.1 back in December, but hedged its bets on Thursday by saying the update might arrive in the “coming weeks.”

Lead image by Reuters