Re: the title of this post, $70k is the bounty paid to the researcher, and "accidental" refers to the fact he came across the bug during personal use of his Pixel phone, not during testing.
Accidental Google Pixel Lock Screen Bypass
151–160 of 475 posts
Re: Accidental Google Pixel Lock Screen Bypass
#152Every once in a blue moon when I pick up my locked iPhone (which auto-locks in just 30 seconds) and engage the home button just as the screen comes alive from the gyro sensing movement, it unlocks on its own. It just flashes the PIN dialog and slides right onto the home screen. I don't use Touch ID, and never stored my print with it even once to test the feature/hardware. It's been happening ever since iOS 11, with b…
Delete this comment and write a bug, you could get $100k
No post body was provided.
Re: Accidental Google Pixel Lock Screen Bypass
#153> The bug just got fixed in the November 5, 2022 security update. Lovely. My Pixel 4 got it's last update in Oct.
[deleted]
Re: Accidental Google Pixel Lock Screen Bypass
#154I wish closing things as "this is a duplicate" essentially required disclosure of the original (dupe) report. It may well be that it's a dupe, or it may be something that looks similar but not actually the same. And indeed as in this case it's only the follow up report that got the bug fixed. In this case it seems that contacts at google allowed them to escalate anyway and get it fixed. But so often and especially wi…
Everyone who reports a undisclosed bug should get a share of the bounty; this incentivizes them to stick to the embargo. If too many people are reporting the bug before you fix it then you have other problems. I also start to feel that at Google's scale bounties this serious should start doubling every month.
> Everyone who reports an undisclosed bug should get a share of the bounty; this incentivizes them to stick to the embargo.
Having worked with but bounty programs, I can guarantee this would be abused to no end. Reporters would enlist their friends and family to submit as many duplicate reports as possible.
There are a lot of good security researchers out there doing work in public, but bug bounty programs also get flooded by people looking to game the system in any way possible.
Re: Accidental Google Pixel Lock Screen Bypass
#155Bottomline: have buddies at Google if you want anything ever get fixed.
and Facebook... and every other company too cheap to pay for support.
Re: Accidental Google Pixel Lock Screen Bypass
#156Earlier quoted context omitted.
There have been MANY such attacks against the iPhone (and every other device), most of them against the biometrics mechanisms, which tend to be pretty weak as a matter of first principles. Add to that the persistent hints/rumors/claims of gray market unlock/rooting kits available to large entities. Phones just aren't that secure, though they're much more so than they were a decade ago. Security vs. physical access is…
Okay, but fooling a biometrics sensor is not exactly a Lock Screen bypass. Has iOS had a Lock Screen bypass?
Fooling a biometric sensor is precisely a lock screen bypass, that's what the biometrics are for. By that logic the linked bug was "fooling the SIM security layer" and not a "lock screen bypass". Don't play that game, it's bad logic and bad security practice.
Re: Accidental Google Pixel Lock Screen Bypass
#157Earlier quoted context omitted.
It read like the payment came only when disclosure was imminent. Google basically extorted themselves into paying it to encourage pushing disclosure out a couple months.
Security through ̶o̶b̶s̶c̶u̶r̶i̶t̶y̶ bribery *Edit: ̶H̶o̶w̶ ̶t̶o̶ ̶s̶t̶r̶i̶k̶e̶t̶h̶r̶o̶u̶g̶h̶?̶ - cheers
Not sure if they have that https://news.ycombinator.com/formatdoc
Re: Accidental Google Pixel Lock Screen Bypass
#158It's somewhat interesting that there was never a major public pressure campaign by the FBI to force Android phones to be backdoored, as there was with Apple. Maybe this was the tactic used by law enforcement (and others most likely) to unlock Android phones? Maybe Google knew about it and that accounts for their stalling on providing a fix?
Yes, that's how you start thinking after reading Yasha Levine's Surveillance Valley.
Re: Accidental Google Pixel Lock Screen Bypass
#159It's somewhat interesting that there was never a major public pressure campaign by the FBI to force Android phones to be backdoored, as there was with Apple. Maybe this was the tactic used by law enforcement (and others most likely) to unlock Android phones? Maybe Google knew about it and that accounts for their stalling on providing a fix? Yes, that's how you start thinking after reading Yasha Levine's Surveillance…
That actually sounds plausible. It’s a pretty simple explanation that would explain all the issues in the post.
Re: Accidental Google Pixel Lock Screen Bypass
#160Earlier quoted context omitted.
It read like the payment came only when disclosure was imminent. Google basically extorted themselves into paying it to encourage pushing disclosure out a couple months.
Security through ̶o̶b̶s̶c̶u̶r̶i̶t̶y̶ bribery *Edit: ̶H̶o̶w̶ ̶t̶o̶ ̶s̶t̶r̶i̶k̶e̶t̶h̶r̶o̶u̶g̶h̶?̶ - cheers
As far as I'm aware you can't, maybe this works though https://unicode-table.com/en/tools/strikethrough-text/
̶t̶e̶s̶t̶