Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accidental Google Pixel Lock Screen Bypass

bugs.xdavidhu.me

Post reply on HN
Print view View original

111–120 of 475 posts

Re: Accidental Google Pixel Lock Screen Bypass

#111

Post by Apreche »

lupire wrote: post #98
Apreche wrote: post #47

Earlier quoted context omitted.

I was also thinking they should only dismiss by ID instead of type. The other question is, why would background tasks be permitted to call dismiss at all? I can imagine a scenario where you get a malware app installed using whatever method. Then when you get physical access to the phone, you send a notification to the malware app. The malware app in the background calls dismiss on every possible type several times to…

If an non-system app can call dismiss at all, it's already game over.

Oh, of course.

Re: Accidental Google Pixel Lock Screen Bypass

#114

Post by izacus »

gcr wrote: post #64
tyingq wrote: post #16

Earlier quoted context omitted.

It didn't work on a fresh reboot, so presumably, it functioned like you're describing. But, when he swapped the sim live, without the reboot, the phone was already running with the key in memory.

On iPhone, keys are evicted from memory when the device is locked. Apps running behind the Lock Screen can only write files to special file inboxes (this is why the camera lets you take pictures while locked but doesn’t display earlier pictures, for example) You’re telling me that android keeps keys in memory for its entire uptime?

That's not really true at all - you can of course unlock your iPhone without entering PIN for every screen lock which should give you a clue that keys for disk encryption generally aren't purged when iPhone is locked.

Some keys are, but not the ones that are the issue here.

I've even seen conditions where iOS devices reboot and still retain keys.

Re: Accidental Google Pixel Lock Screen Bypass

#115

Post by vitiral »

daneel_w wrote: post #52

Every once in a blue moon when I pick up my locked iPhone (which auto-locks in just 30 seconds) and engage the home button just as the screen comes alive from the gyro sensing movement, it unlocks on its own. It just flashes the PIN dialog and slides right onto the home screen. I don't use Touch ID, and never stored my print with it even once to test the feature/hardware. It's been happening ever since iOS 11, with b…

Delete this comment and write a bug, you could get $100k

Re: Accidental Google Pixel Lock Screen Bypass

#116

Post by jbuhbjlnjbn »

lupire wrote: post #94
acdha wrote: post #61

Earlier quoted context omitted.

I’ve run into this with other vendors and really wished it’d get you CCed on updates so you didn’t have to ask for status periodically. It definitely doesn’t give a good impression when things drag out for aeons.

What's crazy is that it's 100% in the vendor's interest to keep this person happy, who they know can cause massive damage to their system, completely legally. The only leverage they have is the reporter's greed to get a bounty.

It's not greed to hold a company accountable to its promises of compensation.

Even so, surprisingly many researchers disclose a bug after setting a reasonable fix deadline, risking to forfeit compensation. Kudos to them!

Re: Accidental Google Pixel Lock Screen Bypass

#117

Post by vitiral »

lupire wrote: post #103
vitiral wrote: post #78

> When the SIM PUK was reset successfully, a .dismiss() function was called by the PUK resetting component on the “security screen stack”, causing the device to dismiss the current one and show the security screen that was “under” it in the stack Oh, the exceptional safety of object oriented programming!

There's nothing OOP-specific about this bug. The bug is in too-wide variable scoping, insufficient OO really.

It calls .dismiss() expecting the PUK screen but it's a different object instead. This is the kind of thing that OOP rely on.

Re: Accidental Google Pixel Lock Screen Bypass

#118

Post by krzyk »

makeitdouble wrote: post #41
foverzar wrote: post #34

Earlier quoted context omitted.

> Despite having all the hardware on the phone Did Pixel phones really have a frontal lidar?

Pixel 4 had dedicated hardware (project Soli)

Soli != hardware for face unlock.

It had 2xIR cameras, flood illuminator and a dot project for that purpose. Soli was a gimmick on top of that, so it would enable that hardware above when you were reaching with your hand for the phone.

In my case it was a gimmick because I don't see much difference between face unlock times when I reach for the phone and the most useful feature for me (swiping to change music) was working also when my windshield had wipers working.

I dream of a Pixel with normal face unlock (like in Pixel 4, not the crippled on in Pixel 7) but without Soli.

I can't believe that they ditched it after just one generation, now I'm stuck. And only reason to upgrade would be a Pixel that has photos >12mpix (not just the sensor).

Re: Accidental Google Pixel Lock Screen Bypass

#119

Post by lrvick »

not1ofU wrote: post #59
lrvick wrote: post #43

Earlier quoted context omitted.

The security researchers only mistake was letting Google fart around for so long. You give them 90 days, then you go public. That is the policy Google Project Zero holds other companies to, so it is only fair to hold Google to the same standard. People using their device for high risk applications need to be informed in a timely manner, and Google needs to pay a reputational price for their negligence.

70,000 reasons to think long and hard about that appraoch though :-D

An alternative would be to go show a bunch of journalists that you can unlock their phone and have this all over the news. You get your name /really/ out there for holding Google accountable for security negligence and ignoring a very reasonable 90 day window. The exposure could lead to millions in security consulting contract work over time if played right.

Disclosing on time is a way to force companies to fix the bugs, and to get a major social capital boost that can be used to get a return on the time investment.

Personally I love when companies try to call my bluff. Great chance to educate the public on why they should not be trusted.

Re: Accidental Google Pixel Lock Screen Bypass

#120

Post by ccouzens »

gcr wrote: post #64
tyingq wrote: post #16

Earlier quoted context omitted.

It didn't work on a fresh reboot, so presumably, it functioned like you're describing. But, when he swapped the sim live, without the reboot, the phone was already running with the key in memory.

On iPhone, keys are evicted from memory when the device is locked. Apps running behind the Lock Screen can only write files to special file inboxes (this is why the camera lets you take pictures while locked but doesn’t display earlier pictures, for example) You’re telling me that android keeps keys in memory for its entire uptime?

Presumably not all keys?

If you receive a phone call while locked presumably the phone can still access the address book to display the contact name and photo?

And music playing apps can presumably access their database of music to play songs whilst the phone is locked?

Post reply on HN