Live data from Hacker News

Accidental Google Pixel Lock Screen Bypass

bugs.xdavidhu.me

261–270 of 475 posts

Re: Accidental Google Pixel Lock Screen Bypass

#261
post #245

So basically google wanted to give this guy nothing. Then he set a hard deadline for disclosure and google managed to buy him for 70k so they could stick with their own deadline.

Or more charitably, by the terms of the program he wasn't eligable for anything, but they gave him seventy thousand dollars out of goodwill and the spirit of the program.

Re: Accidental Google Pixel Lock Screen Bypass

#262

I went to buy a phone maybe two months ago. Before I had my current Google Pixel 6, I used a OnePlus 3T for six years, and even then I only stopped because I sat in a hot tub with it on. At the T-Mobile store, I announced to the salesman that I would be back to buy a Pixel 6 when they had it in stock, and a man pulled me aside and privately asked me why I wanted to buy a Pixel. He explained to me that he was actually…

The main reason for this is just fucking iMessage.

It's not even just that iMessage segregates non-iPhone messages by color. It screws up video and group texts.

Re: Accidental Google Pixel Lock Screen Bypass

#263

Earlier quoted context omitted.

I'm... not sure that I would take a random person* in a T-Mobile store at their word when they claimed that they were "actually working in the hardware division at Google."

In the story above he says he wants to buy a pixel to the salesperson, but it is someone else that says they work at Google.

Thanks, I've updated "salesperson" to "person."

Re: Accidental Google Pixel Lock Screen Bypass

#264

Earlier quoted context omitted.

I'm... not sure that I would take a random person* in a T-Mobile store at their word when they claimed that they were "actually working in the hardware division at Google."

In the story above he says he wants to buy a pixel to the salesperson, but it is someone else that says they work at Google.

So basically, even sketchier.

Re: Accidental Google Pixel Lock Screen Bypass

#265
post #185

Earlier quoted context omitted.

LEO already have access to locked phones via stuff like GrayKey. https://www.grayshift.com/graykey/

I am always skeptical of these "lawtech" companies that sell magic unlocking devices. Are we really to believe that there are unpatched security holes in all major devices (both Android and iOS) that allow this kind of backdoor access? I find it rather convenient that the "detailed support matrix" is only available for current customers only, seems to me like the actual amount of supported devices/operating systems w…

Confiscated phones often have been confiscated for months and are therefore on a relatively old patch level. If at any point old vulnerabilities come out these can be used. Keeping the phones on and connected to a charger in the evidence lockers doesn't seem like too much work.

Re: Accidental Google Pixel Lock Screen Bypass

#267

Earlier quoted context omitted.

I am always skeptical of these "lawtech" companies that sell magic unlocking devices. Are we really to believe that there are unpatched security holes in all major devices (both Android and iOS) that allow this kind of backdoor access? I find it rather convenient that the "detailed support matrix" is only available for current customers only, seems to me like the actual amount of supported devices/operating systems w…

It works. It's basically a software brute force that works great for 4 digit pins, takes longer for longer passcodes. Other offerings are a keylogger for the pin/passwords after they "return" the device to the suspect.

How would you install a keylogger on an encrypted device without rooting it or deleting user data?

Re: Accidental Google Pixel Lock Screen Bypass

#268

Earlier quoted context omitted.

Yeah for purposes of the reward it should only be allowed to be considered a dupe if it duplicates a disclosed bug.

I suppose the risk is people could 'game' the system. Person A finds the issue, reports it. Then Person A secretly tells Person B about it (with no apparent connection), and Person B reports the same issues a few weeks later, but with apparent different code/description to look ever so slightly different.

Split the reward between everyone who reported it. It's even still kind of fair: The more people find it the easier it was to find.

Re: Accidental Google Pixel Lock Screen Bypass

#270

THIS IS ABSOLUTELY CRAZY! I have personally tested this on my Non-pixel Android 12 device and it works. My findings: - The exploit works even on first pwd input screen on boot. however, the filesystem is still encrypted and cannot be accessed by any means (ADB/MTP). launcher does not load fully. but settings and other things accesible from notification panel can be launched (BT/Hotspot etc). you can get list of insta…

What specific device do you have?
Post reply on HN