Open Radar

 
Summary:
A thief or attacker shouldn't be able to put a locked iPhone in Airplane Mode, since this would prevent Find my iPhone and remote wiping from working. That's why Siri requests you to unlock the iPhone first if you ask her to switch on Airplane mode from the lock screen.

However, if you just ask Siri "is Airplane mode on?", it will give you a toggle to switch it on without requesting the user to unlock the device. This is clearly an oversight and serious security flaw.

Here's even a Youtube video showing the issue: https://www.youtube.com/watch?v=lb93cZ1EwKk

Of course you could still deactivate Siri on the lock screen (like Control Center), but that would seriously diminish its usefulness. I would even argue that Control Center should lose the ability to toggle Airplane mode from the lock screen too, so that it can be available without the security risk.

Steps to Reproduce:
1. Lock the device with Airplane mode off
2. Activate Siri (with an unregistered finger to not unlock via TouchID)
3. Say "Is Airplane mode on?"

Expected Results:
Siri should answer: "No. To switch it on, you'll need to unlock you iPhone first"

Actual Results:
Siri answers "No, Airplane mode is off." AND displays a toggle to switch it on, with no need to unlock the device first.

Version:
iOS 9.0.1 (13A405)