Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accidental Google Pixel Lock Screen Bypass

bugs.xdavidhu.me

Post reply on HN
Print view View original

231–240 of 475 posts

Re: Accidental Google Pixel Lock Screen Bypass

#231

Post by Gilboboy »

perlgeek wrote: post #12
sunaurus wrote: post #10

I was under the impression that decrypting storage actually requires the passcode of the phone, but this bug makes it look like the device is able to decrypt itself without any external input. Does anybody know more context about this? What's the point of encryption if the device can just essentially backdoor decrypt itself?

It seems to me this bug appears when a phone is booted, unlocked (and decrypted) once, and then locked again, but the decryption key still stays in memory.

This is virtually always the case with these kinds of vulnerabilities on smartphones. Security researchers often say whether an attack or vulnerability is possible "before/after first unlock" in reference to the fact that the security is a totally different story if the phone has been unlocked/decrypted since last boot.

Re: Accidental Google Pixel Lock Screen Bypass

#232

Post by avianlyric »

cr4nberry wrote: post #216
krajzeg wrote: post #89

Earlier quoted context omitted.

Agreed. The fixed logic, at least judging by the commit message, still feels very shaky on correctness grounds ("if we are dismissing something that doesn't seem to be right, ignore it"). Since they're rewriting code and changing method signatures anyway, I would prefer they got rid of the notion of "currently visible screen" and made sure that all dismiss() calls have a unique pointer or token pointing to what exact…

This just sounds like you're prematurely optimizing for additional security screens getting added. Maybe that's not on the table atm? Still odd that they took so long to change a couple method signatures and write a couple test cases

They already have multiple security screens, and a demonstrated critical bug with security screen confusion. Not sure how this is premature optimisation.

Re: Accidental Google Pixel Lock Screen Bypass

#233

Post by staringback »

_kbh_ wrote: post #185
tyingq wrote: post #136

I wonder how many LEO agencies are now digging androids out of the evidence closet.

LEO already have access to locked phones via stuff like GrayKey. https://www.grayshift.com/graykey/

I am always skeptical of these "lawtech" companies that sell magic unlocking devices. Are we really to believe that there are unpatched security holes in all major devices (both Android and iOS) that allow this kind of backdoor access?

I find it rather convenient that the "detailed support matrix" is only available for current customers only, seems to me like the actual amount of supported devices/operating systems would be limited to things such as outdated Samsung Galaxy phones and similar.

Re: Accidental Google Pixel Lock Screen Bypass

#234

Post by someweirdperson »

Tepix wrote: post #106
someweirdperson wrote: post #40

But for sure the instruction manual says that the sim can only be inserted/removed while the device is off? Security is ensured!

Why do you think so?

Think? Ok, I checked. And it IS in the manual. From the google pixel help [0]:

> "Insert a SIM card > With your phone off:"

[0] https://support.google.com/pixelphone/answer/7086887?hl=en

Re: Accidental Google Pixel Lock Screen Bypass

#235

Post by octagonal »

izacus wrote: post #180
notRobot wrote: post #5

Seems to me like this impacts not only Pixel devices but all Android devices? Patch was to AOSP: https://github.com/aosp-mirror/platform_frameworks_base/comm... I don't have a locked SIM handy, but can someone please test on their non-Pixel device and confirm?

Thing is, most phone manufacturers will customize the lockscreen quite a bit, so it's possible (but not necessary!) it affects others.

I don't think many phone OEMs will actually take the effort to muck around in the lock screen mechanisms.

Re: Accidental Google Pixel Lock Screen Bypass

#236

Post by octagonal »

SamBam wrote: post #210
albertzeyer wrote: post #176

Earlier quoted context omitted.

You can read in the conversation that Google was not able to reproduce it the first time the bug was submitted: > The same issue was submitted to our program earlier this year, but we were not able to reproduce the vulnerability. When you submitted your report, we were able to identify and reproduce the issue and began developing a fix. I wonder if it really was the same bug or what they did wrong to reproduce it. Or…

Agreed. If the first bug was > I did something weird after putting in a new PIN, and I was able to access my home screen without my password, but I'm not sure of the exact steps I did then that's not really a duplicate. If the original bug report doesn't have enough information to recreate the steps, the second one is the only real bug report.

Yes. The first one is more like a user complaint than an actual reproducible bug report.

Re: Accidental Google Pixel Lock Screen Bypass

#237

Post by cr4nberry »

avianlyric wrote: post #232
cr4nberry wrote: post #216

Earlier quoted context omitted.

This just sounds like you're prematurely optimizing for additional security screens getting added. Maybe that's not on the table atm? Still odd that they took so long to change a couple method signatures and write a couple test cases

They already have multiple security screens, and a demonstrated critical bug with security screen confusion. Not sure how this is premature optimisation.

because if the number of screens is small and there are few tiers (only 2), passing an identifier around could be overkill

sounds to me like it's an optimization for introducing more tiers than what there are

Re: Accidental Google Pixel Lock Screen Bypass

#238

Post by macintux »

MPSimmons wrote: post #93
daneel_w wrote: post #52

Every once in a blue moon when I pick up my locked iPhone (which auto-locks in just 30 seconds) and engage the home button just as the screen comes alive from the gyro sensing movement, it unlocks on its own. It just flashes the PIN dialog and slides right onto the home screen. I don't use Touch ID, and never stored my print with it even once to test the feature/hardware. It's been happening ever since iOS 11, with b…

Do you have an Apple Watch? My phone unlocks as long as I'm nearby, wearing the watch and have it unlocked.

But the Watch tells you it’s unlocking the phone.

Re: Accidental Google Pixel Lock Screen Bypass

#239

Post by noasaservice »

onychomys wrote: post #207
noasaservice wrote: post #81

Good reason to not disclose to Google. Instead, you should sell the exploit on the exploit dealers sites. This is easily worth $300-500k But not now. And you have the 'privilege' of being dicked around with people googling you.

Maybe having morals is worth $230k to the author.

You can say that, but he was going to get $0 if he already didn't have internal connections to google.

If these companies try to cheap people out of what bounties they offer, then they need reminded that they're not the only game in town that'll pay for exploits.

Re: Accidental Google Pixel Lock Screen Bypass

#240

Post by DonHopkins »

izacus wrote: post #178
joezydeco wrote: post #161

Earlier quoted context omitted.

Am I reading this right? This reads like the presence of a UI element holds the unlock state of the phone?

No, not exactly, but Android is old and gnarly enough that a lot of components don't have a clear Model/View separation you'd expect in modern codebases.

The good old "Model / View / Confuser" paradigm.
Post reply on HN