Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accidental Google Pixel Lock Screen Bypass

bugs.xdavidhu.me

Post reply on HN
Print view View original

291–300 of 475 posts

Re: Accidental Google Pixel Lock Screen Bypass

#291

Post by WaitWaitWha »

michaelbuckbee wrote: post #198
WaitWaitWha wrote: post #192

> I decided to stick with my October deadline. [...] > I also decided (even before the bounty) that I am too scared to actually put out the live bug and since the fix was less than a month away, it was not really worth it anyway. I decided to wait for the fix. I have gone through similar trepidation. What were you scared of?

Security researchers (like the one here) don't want harm to come to people from their actions. If they announced the live bug before it was patched a lot of people and organizations might have been adversely by this before the fix was applied.

Right.

I should have asked "at what point did you decide that the wait outweighs the risk?"

That is, at what point wait becomes too long, and is worse?

Re: Accidental Google Pixel Lock Screen Bypass

#292

Post by [deleted] »

Gasp0de wrote: post #267
vvilliamperez wrote: post #255

Earlier quoted context omitted.

It works. It's basically a software brute force that works great for 4 digit pins, takes longer for longer passcodes. Other offerings are a keylogger for the pin/passwords after they "return" the device to the suspect.

How would you install a keylogger on an encrypted device without rooting it or deleting user data?

[deleted]

Re: Accidental Google Pixel Lock Screen Bypass

#293

Post by qwertox »

bluocms wrote: post #7

How come the security model is so basic? I even think they should dismiss modal by id instead of type. As this is a highly sensitive part, I think stacking lock screens on top of the unlocked menu leaves the door open for many bugs that could unlock your device. The unlocked menu should be locked at all times, and use a flag to monitor if it’s locked/unlocked, and only flip the flag when you unlock with biometrics or…

I was thinking that if I would have to code this, at least once this issue would cross my mind, the question of "what happens when there are multiple screens stacked" and how it should get handled properly. This is what meetings are there for, to discuss such issues.

It almost sounds intentional, but at the very least like a very sluggish approach to security.

Re: Accidental Google Pixel Lock Screen Bypass

#294

Post by qwertox »

ballenf wrote: post #227
bluocms wrote: post #7

How come the security model is so basic? I even think they should dismiss modal by id instead of type. As this is a highly sensitive part, I think stacking lock screens on top of the unlocked menu leaves the door open for many bugs that could unlock your device. The unlocked menu should be locked at all times, and use a flag to monitor if it’s locked/unlocked, and only flip the flag when you unlock with biometrics or…

I think an even better approach would be to have the concept of fixed tiers of locking combined with evicting the decryption key for any Lock Screen above the basic PIN. And you can only move down one tier of unlocking at a time. Unlocking SIM PIN moves you down one tier to phone PIN screen.

I'd go for one screen with a queue of prioritized unlocking tasks which need to be completed successfully one after the other. These tasks could get the chance to hand over a fragment which the screen embeds and presents to the user, in order to properly modularize the tasks.

Re: Accidental Google Pixel Lock Screen Bypass

#295

Post by advisedwang »

mod wrote: post #272
arsome wrote: post #264

Earlier quoted context omitted.

So basically, even sketchier.

No, I'm quite more likely to believe that a customer at T-Mobile is a googler than to believe that the salesman is.

Especially if this is a store in mountain view!

Re: Accidental Google Pixel Lock Screen Bypass

#296

Post by cwkoss »

ZiiS wrote: post #241
Gasp0de wrote: post #224

Earlier quoted context omitted.

The latter does incentivize everyone who stumbles across the bug to not disclose it. At the same time, it's sad for the original researcher whose bounty gets smaller with every new person stumbling across it.

It dose imply that finding it was easier then ones where you are the only reporter; partially justifying lower rewards.

No. A bug that can be trivially found is higher likelihood of being exploited, and thus higher impact.

Re: Accidental Google Pixel Lock Screen Bypass

#297

Post by some_random »

staringback wrote: post #233
_kbh_ wrote: post #185

Earlier quoted context omitted.

LEO already have access to locked phones via stuff like GrayKey. https://www.grayshift.com/graykey/

I am always skeptical of these "lawtech" companies that sell magic unlocking devices. Are we really to believe that there are unpatched security holes in all major devices (both Android and iOS) that allow this kind of backdoor access? I find it rather convenient that the "detailed support matrix" is only available for current customers only, seems to me like the actual amount of supported devices/operating systems w…

It's complicated, but yes there are a lot of ways to unlock devices some of which include straight up exploiting the device. Keep in mind btw that a lot of the sorts of criminals local LE is going after with these devices are not usually running fully patched iphones or pixels.

Re: Accidental Google Pixel Lock Screen Bypass

#298

Post by rex_lupi »

Daniel_sk wrote: post #270
rex_lupi wrote: post #214

THIS IS ABSOLUTELY CRAZY! I have personally tested this on my Non-pixel Android 12 device and it works. My findings: - The exploit works even on first pwd input screen on boot. however, the filesystem is still encrypted and cannot be accessed by any means (ADB/MTP). launcher does not load fully. but settings and other things accesible from notification panel can be launched (BT/Hotspot etc). you can get list of insta…

What specific device do you have?

The device I tested this on runs a moderately modified AOSP based os. I cannot specify the device model etc. I have also tested this on another LineageOS device and that is also affected. So I suppose any aosp-based rom that isn't heavily modified (like Samsung/MiUI) are affected.

Re: Accidental Google Pixel Lock Screen Bypass

#299

Post by chimprich »

matchbok wrote: post #209

It's quite amazing how poorly designed Android really is. Every single part of that OS is poorly architected and have horrible APIs. What a shame.

Considering it's probably the world's most used OS, it's laughable. They churn out new recommendations constantly only to deprecate it again and think of some new tedious convoluted approaches a short time later. I think it's a combination of poor judgment and Google's toxic internal incentives to design crazy new stuff.

Re: Accidental Google Pixel Lock Screen Bypass

#300

Post by SV_BubbleTime »

staringback wrote: post #233
_kbh_ wrote: post #185

Earlier quoted context omitted.

LEO already have access to locked phones via stuff like GrayKey. https://www.grayshift.com/graykey/

I am always skeptical of these "lawtech" companies that sell magic unlocking devices. Are we really to believe that there are unpatched security holes in all major devices (both Android and iOS) that allow this kind of backdoor access? I find it rather convenient that the "detailed support matrix" is only available for current customers only, seems to me like the actual amount of supported devices/operating systems w…

>Are we really to believe that there are unpatched security holes in all major devices (both Android and iOS) that allow this kind of backdoor access?

If you are at all familiar with the histories of jailbreaking, previous exploits, and the gray unlock market, it’s unreasonable you would not consider this this to be the default case.

Post reply on HN