Scenario
A researcher previously submitted a report to Product Security that initially seemed like a security issue. After engaging the engineering team, we determined that this was not actually a security issue. An automated email was sent to the researcher informing them it is not a security issue. Respond to the email from the researcher.
Email
Hi Product Security!
For the last few weeks, the status of this report said that you were investigating this issue, and it even said you planned to fix it in Fall. I just got an update that says you no longer think this is a security issue… What happened? I really think that it is important for Apple to fix this issue to protect its customers!
Please respond to me ASAP. I look forward to hearing from you.
Researcher Report
Title: Unauthorized Access to Photo Library via Camera App on Lock Screen
I am reporting a security concern where a user can access their photo library from the lock screen after launching the Camera app. This behavior bypasses the intended security restrictions of the lock screen, potentially exposing private photos to unauthorized viewers.
Issue Description:
When the Camera app is launched from the lock screen, users can interact with recently taken photos or swipe to view their photo library without unlocking the device. This access could unintentionally expose private or sensitive images.
Steps to Reproduce:
- Ensure the Camera app is accessible from the lock screen in device settings.
- Lock the iPhone and access the lock screen.
- Swipe to open the Camera app.
- Take a photo or video.
- Tap on the thumbnail of the captured photo or swipe left to view other photos in the library.
- The user is able to view stored images or videos without unlocking the device.
Impact:
- Privacy Violation: Sensitive images or videos stored in the library can be accessed without authentication.
- Data Exposure: In case of theft or unauthorized access, this behavior could compromise the user’s privacy.
Proposed Solutions:
- Restrict access to the photo library from the lock screen by requiring authentication before allowing users to view or swipe beyond newly captured media.
- Limit the Camera app on the lock screen to capturing photos and videos without access to the photo library.
- Provide an option for users to disable thumbnail previews in the Camera app on the lock screen.
Affected Devices:
This issue has been observed on iPhones running iOS 18.1 where the Camera app is accessible from the lock screen.
这道题本质上是在模拟一封给研究员的回复邮件：需要先肯定对方的反馈，再礼貌说明团队复现后的结论——锁屏相机里看到的内容仅限于设备锁定时新拍摄的照片，不会在未解锁情况下浏览历史相册，因此不构成可利用的安全漏洞。写作时重点是保持专业、克制、同理心强，同时避免使用过于强硬的否定措辞。
