For those paranoid spy folks out there, SRLabs has pointed out an additional security weakness which could help an attacker use the fingerprint hack to access an iPhone 5s.

The fingerprint hack takes time: around half an hour of actual work, plus drying time. Provided you notice your phone has gone before the thief gains access, you can simply remotely lock or wipe the phone. But with Airplane Mode accessible from the control center on the lockscreen, a thief can simply enable this to prevent the phone being wiped while they are dealing with the fingerprint … 

Once a thief has used a spoofed fingerprint to gain access, they could use the Apple ID ‘forgotten password’ link to have a password reset link sent to the phone. With the Apple ID changed, the thief can safely switch Airplane Mode off knowing that the owner will no longer be able to wipe it.

There are a couple of things you can do to to guard against this. First, go into Settings -> Control Center and switch off Access on Lock Screen:


Second, as soon as you find your phone has gone, use another device to change your email password. That way, if the thief gains access, they won’t have access to new emails, so won’t be able to receive the password reset link.

As we said before, however, this isn’t a trivial hack, it’s something that requires a considerable amount of time, effort, skill and equipment. The question then becomes: is the data on your phone worth that effort? If you’re the CEO of a Silicon Valley startup, maybe. If you’re the average guy on the street, it’s unlikely to be something you have to worry about.