Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accidental Google Pixel Lock Screen Bypass

bugs.xdavidhu.me

Post reply on HN
Print view View original

21–30 of 475 posts

Re: Accidental Google Pixel Lock Screen Bypass

#21

Post by eterm »

I wish closing things as "this is a duplicate" essentially required disclosure of the original (dupe) report.

It may well be that it's a dupe, or it may be something that looks similar but not actually the same. And indeed as in this case it's only the follow up report that got the bug fixed.

In this case it seems that contacts at google allowed them to escalate anyway and get it fixed.

But so often and especially with other programs almost everything gets closed as "dupe" which is just dispiriting.

In any case, if something this serious is a duplicate then there's the suspicion it went unfixed for long enough to be independently discovered and reported which is worrying.

Re: Accidental Google Pixel Lock Screen Bypass

#22

Post by notyourday »

phreack wrote: post #11

I can't believe this is not a "drop everything and get it fixed ASAP" bug. This makes me think there's probably tons of other similar bugs out there being exploited right now even with disclosure.

There's exactly one drop everything and get it fixed ASAP bug at Google - something broke the ad platform.

Re: Accidental Google Pixel Lock Screen Bypass

#23

Post by MauranKilom »

> The same issue was submitted to our program earlier this year, but we were not able to reproduce the vulnerability. When you submitted your report, we were able to identify and reproduce the issue and began developing a fix.

> We typically do not reward duplicate reports; however, because your report resulted in us taking action to fix this issue, we are happy to reward you the full amount of $70,000 USD for this LockScreen Bypass exploit!

Lots of mixed feelings just reading this, but at least in the end it seems like a positive outcome for everyone.

Re: Accidental Google Pixel Lock Screen Bypass

#24

Post by kaimalcolm »

Appalling handling on Google’s end here. The duplicate issue part I can understand, but why should it take two reports of a critical vulnerability to take action? Surely when the first one comes through it’s something you jump on, fix and push out ASAP, not give delay to the point where a second user can come along, find the bug, and report it.

The refactor that’s mentioned towards the end of the article is great, but would you not just get a fix out there as soon as possible, then work on a good fix after that? For a company that claims to lead the way in bug bounty programs this is a pretty disappointing story.

Re: Accidental Google Pixel Lock Screen Bypass

#25

Post by Semaphor »

notRobot wrote: post #5

Seems to me like this impacts not only Pixel devices but all Android devices? Patch was to AOSP: https://github.com/aosp-mirror/platform_frameworks_base/comm... I don't have a locked SIM handy, but can someone please test on their non-Pixel device and confirm?

Not testing it right now, but my understanding is, that the issue is technically for every device, but the specific condition (putting the lockscreen on top of the secure screen stack right before `.dismiss()`-ing) is a Pixel software bug.

Re: Accidental Google Pixel Lock Screen Bypass

#27

Post by sschueller »

endisneigh wrote: post #20

This is a great example of why you should use iOS. Most android devices do not receive security updates long enough to get this update. Since the author effectively tells you how to do it, all you need to do is find a pixel 4 or older and you’re golden.

It's also a great example why not to use iOS. If you find a hardware flaw in an iPhone and it can't be patched then literally everyone is effected. Even worse is if Apple decides you can no longer use feature/app, it's gone.

Fragmentation has it's issues but centralisation is way worse.

Re: Accidental Google Pixel Lock Screen Bypass

#29

Post by endisneigh »

sschueller wrote: post #27
endisneigh wrote: post #20

This is a great example of why you should use iOS. Most android devices do not receive security updates long enough to get this update. Since the author effectively tells you how to do it, all you need to do is find a pixel 4 or older and you’re golden.

It's also a great example why not to use iOS. If you find a hardware flaw in an iPhone and it can't be patched then literally everyone is effected. Even worse is if Apple decides you can no longer use feature/app, it's gone. Fragmentation has it's issues but centralisation is way worse.

Everything you described is also true of android. Fact remains that even flagship android vendors support updates for much less time than apple.

Re: Accidental Google Pixel Lock Screen Bypass

#30

Post by ApolloFortyNine »

endisneigh wrote: post #20

This is a great example of why you should use iOS. Most android devices do not receive security updates long enough to get this update. Since the author effectively tells you how to do it, all you need to do is find a pixel 4 or older and you’re golden.

Who knows how many bugs live in iOS as well. Security through obscurity (iOS is closed source) isn't usually considered that great a strategy.

Besides the whole "can't install user software" issue.

Post reply on HN