Accidental Google Pixel Lock Screen Bypass • Hacker News Board

Re: Accidental Google Pixel Lock Screen Bypass

#301

Post by acchow » Thu, Nov 10, 2022, 5:10 PM UTC

ccouzens wrote: post #120

gcr wrote: post #64

Earlier quoted context omitted.

On iPhone, keys are evicted from memory when the device is locked. Apps running behind the Lock Screen can only write files to special file inboxes (this is why the camera lets you take pictures while locked but doesn’t display earlier pictures, for example) You’re telling me that android keeps keys in memory for its entire uptime?

Presumably not all keys? If you receive a phone call while locked presumably the phone can still access the address book to display the contact name and photo? And music playing apps can presumably access their database of music to play songs whilst the phone is locked?

Could be reading a cached copy of the contact list since it’s not very big

The music playing is a different story

Re: Accidental Google Pixel Lock Screen Bypass

#302

Post by titaniczero » Thu, Nov 10, 2022, 5:13 PM UTC

GaryPalmer wrote: post #258

kaimalcolm wrote: post #24

Appalling handling on Google’s end here. The duplicate issue part I can understand, but why should it take two reports of a critical vulnerability to take action? Surely when the first one comes through it’s something you jump on, fix and push out ASAP, not give delay to the point where a second user can come along, find the bug, and report it. The refactor that’s mentioned towards the end of the article is great, bu…

Quoted post unavailable.

They ended up rewarding him with $70,000 tho

Re: Accidental Google Pixel Lock Screen Bypass

#303

Post by scarmig » Thu, Nov 10, 2022, 5:13 PM UTC

maerF0x0 wrote: post #283

> During the life of this bug, since the official bug ticket was not too responsive, I sometimes got some semi-official information from Googlers. I actually prefer to only get updates on the official channel, which is the bug ticket and which I can disclose, but since I was talking with some employees, I picked up on bits and pieces. This is going to be one if the uncounted casualties of a downturn in tech and layof…

Turmoil isn't a good description of Google right now, though. It's far from healthy, but it has avoided mass layoffs so far, and the bug was filed in June.

Re: Accidental Google Pixel Lock Screen Bypass

#304

Post by ngm___ » Thu, Nov 10, 2022, 5:15 PM UTC

sunaurus wrote: post #10

I was under the impression that decrypting storage actually requires the passcode of the phone, but this bug makes it look like the device is able to decrypt itself without any external input. Does anybody know more context about this? What's the point of encryption if the device can just essentially backdoor decrypt itself?

  It was a fresh boot, and instead of the usual lock icon, the fingerprint icon
  was showing. It accepted my finger, which should not happen, since after a
  reboot, you must enter the lock screen PIN or password at least once to decrypt
  the device.

i was surprised to read this part too. assuming that the author's version of the events are accurate here, my best guess is that the device had not fully powered down, and was in either a low-power/hibernate or find-my-phone mode, where portions of the security subsystem were still powered, hence the device-unlock PIN was still cached. i don't otherwise see how else a fingerprint alone would allow for the device to be unlocked on cold boot.

of course this detail doesn't take away from the rest of the report - great find xdavidhu!

Re: Accidental Google Pixel Lock Screen Bypass

#305

Post by jacooper » Thu, Nov 10, 2022, 5:22 PM UTC

Wait, this bug affects unsupported pixels now right? A Pixel 4 won't have this fixed ?

Re: Accidental Google Pixel Lock Screen Bypass

#306

Post by nerpderp82 » Thu, Nov 10, 2022, 5:24 PM UTC

oneplane wrote: post #188

btown wrote: post #60

The discussion on race conditions at the end is an important one, and IMO the bugfix is a bandage at best: the notion of anything accessing the “current” object after any kind of delay, especially in an event handler, when there is any chance the thing is not a singleton, is a recipe for disaster. In this case, dismissing the “current” security code screen was a supported API surface and that should set off all the r…

I would indeed expect something more robust like a security state machine where not all states can transition to any other state freely. The UI shouldn't even have a say in what transitions are allowed.

The other nice quality if your code is in a state machine is that it can verified by a model checker.

You might like this post on statig, an HSM library for Rust

https://old.reddit.com/r/rust/comments/yqp2cq/announcing_sta...

Re: Accidental Google Pixel Lock Screen Bypass

#307

Post by ruined » Thu, Nov 10, 2022, 5:26 PM UTC

jacooper wrote: post #305

Wait, this bug affects unsupported pixels now right? A Pixel 4 won't have this fixed ?

if your patch level is less than 2022-11-05 you are affected :D

Re: Accidental Google Pixel Lock Screen Bypass

#308

Post by titaniczero » Thu, Nov 10, 2022, 5:27 PM UTC

tyingq wrote: post #17

Waterluvian wrote: post #4

Given the bug was already reported (and even more ignored) it seems like the $70,000 was really a “you made us do our jobs” fee.

It read like the payment came only when disclosure was imminent. Google basically extorted themselves into paying it to encourage pushing disclosure out a couple months.

Yeah, they tried to set up a call to dissuade him but he stood by his decision. Then only 3 days before the disclosure deadline they decided to pay out.

Re: Accidental Google Pixel Lock Screen Bypass

#309

Post by owenpalmer » Thu, Nov 10, 2022, 5:28 PM UTC

Very well written, thank you.

Re: Accidental Google Pixel Lock Screen Bypass

#310

Post by joecool1029 » Thu, Nov 10, 2022, 5:29 PM UTC

julianlam wrote: post #253

rippercushions wrote: post #248

Earlier quoted context omitted.

Out of curiosity, why have you been regretting it? I've been using Pixels for quite a while now and generally been quite happy.

There are plenty of reasons that people how to spell it over the years, but none are actual red flags. For example, I think people give Google grief over making it difficult to unlock the bootloader, but the same can be said of every other vendor. In my experience, using the Pixel is good enough that I don't miss my Nokia 6.1 running LineageOS too much .

>For example, I think people give Google grief over making it difficult to unlock the bootloader, but the same can be said of every other vendor.

It's not so much that as it is buying an unlocked Pixel and RMA'ing it when hardware problems happen only to receive a locked phone in return. This is the sort of thing that makes people angry.