Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accidental Google Pixel Lock Screen Bypass

bugs.xdavidhu.me

Post reply on HN
Print view View original

41–50 of 475 posts

Re: Accidental Google Pixel Lock Screen Bypass

#41

Post by makeitdouble »

foverzar wrote: post #34
urthor wrote: post #19

Earlier quoted context omitted.

I forget which Pixel generation. For one generation Google I believe never shipped the ability to unlock your phone with your face. Despite having all the hardware on the phone, it just didn't have the feature. This was a serious feature deficit viz a viz the relevant iPhone at the time. The gossip was, the feature was finished, completely. Had to be ripped out after external pen-testing bypassed it with Facebook pho…

> Despite having all the hardware on the phone Did Pixel phones really have a frontal lidar?

Pixel 4 had dedicated hardware (project Soli)

Re: Accidental Google Pixel Lock Screen Bypass

#42

Post by endisneigh »

ApolloFortyNine wrote: post #30
endisneigh wrote: post #20

This is a great example of why you should use iOS. Most android devices do not receive security updates long enough to get this update. Since the author effectively tells you how to do it, all you need to do is find a pixel 4 or older and you’re golden.

Who knows how many bugs live in iOS as well. Security through obscurity (iOS is closed source) isn't usually considered that great a strategy. Besides the whole "can't install user software" issue.

The number of bugs is not the issue. The issue is that apple supports their devices longer than all android vendors.

Bugs are inevitable and so the difference is support duration and speed.

Re: Accidental Google Pixel Lock Screen Bypass

#43

Post by lrvick »

phreack wrote: post #11

I can't believe this is not a "drop everything and get it fixed ASAP" bug. This makes me think there's probably tons of other similar bugs out there being exploited right now even with disclosure.

The security researchers only mistake was letting Google fart around for so long.

You give them 90 days, then you go public. That is the policy Google Project Zero holds other companies to, so it is only fair to hold Google to the same standard.

People using their device for high risk applications need to be informed in a timely manner, and Google needs to pay a reputational price for their negligence.

Re: Accidental Google Pixel Lock Screen Bypass

#44

Post by jerpint »

mschuster91 wrote: post #31
urthor wrote: post #19

Earlier quoted context omitted.

I forget which Pixel generation. For one generation Google I believe never shipped the ability to unlock your phone with your face. Despite having all the hardware on the phone, it just didn't have the feature. This was a serious feature deficit viz a viz the relevant iPhone at the time. The gossip was, the feature was finished, completely. Had to be ripped out after external pen-testing bypassed it with Facebook pho…

> This was a serious feature deficit viz a viz the relevant iPhone at the time. IIRC, the iPhone uses not just a photo from the selfie cam, but adds infrared to construct a sort-of-3d-ish depth map of your face as well - that is what defeats a simple attempt at unlocking with photos. Now, the really interesting thing to research is if a silicone molded face mask could be used to fool the iPhone into unlocking. Photos…

A video rotating around a subject + nerfs could maybe get you the 3D face copy pretty easily

Re: Accidental Google Pixel Lock Screen Bypass

#45

Post by EspadaV9 »

2OEH8eoCRo0 wrote: post #8

> The bug just got fixed in the November 5, 2022 security update. Lovely. My Pixel 4 got it's last update in Oct.

Could try checking out https://grapheneos.org/, it looks like they are supporting the Pixel 4 for a little longer.

In this case though, you would hope Google release an extra patch for the Pixel 4, they knew this bug was there and a fix was in the pipeline.

Re: Accidental Google Pixel Lock Screen Bypass

#46

Post by endisneigh »

mschuster91 wrote: post #31
urthor wrote: post #19

Earlier quoted context omitted.

I forget which Pixel generation. For one generation Google I believe never shipped the ability to unlock your phone with your face. Despite having all the hardware on the phone, it just didn't have the feature. This was a serious feature deficit viz a viz the relevant iPhone at the time. The gossip was, the feature was finished, completely. Had to be ripped out after external pen-testing bypassed it with Facebook pho…

> This was a serious feature deficit viz a viz the relevant iPhone at the time. IIRC, the iPhone uses not just a photo from the selfie cam, but adds infrared to construct a sort-of-3d-ish depth map of your face as well - that is what defeats a simple attempt at unlocking with photos. Now, the really interesting thing to research is if a silicone molded face mask could be used to fool the iPhone into unlocking. Photos…

Won’t work -

https://9to5mac.com/2019/12/16/3d-mask/amp/

Muscle movement is also now necessary so it’s pretty difficult to circumvent

Re: Accidental Google Pixel Lock Screen Bypass

#47

Post by Apreche »

bluocms wrote: post #7

How come the security model is so basic? I even think they should dismiss modal by id instead of type. As this is a highly sensitive part, I think stacking lock screens on top of the unlocked menu leaves the door open for many bugs that could unlock your device. The unlocked menu should be locked at all times, and use a flag to monitor if it’s locked/unlocked, and only flip the flag when you unlock with biometrics or…

I was also thinking they should only dismiss by ID instead of type.

The other question is, why would background tasks be permitted to call dismiss at all? I can imagine a scenario where you get a malware app installed using whatever method. Then when you get physical access to the phone, you send a notification to the malware app. The malware app in the background calls dismiss on every possible type several times to unlock any possible security screens.

There should be some sort of lock/flag/semaphore that is held by the current top level security screen. Dismiss should only be callable by whatever process has a hold of that. Dismiss calls from anyone else should not only be denied, but processes that make such calls should be blocked, quarantined, marked as suspicious, etc.

Re: Accidental Google Pixel Lock Screen Bypass

#48

Post by alexmolas »

> I mentally noted that this was weird and that this might have some security implications so I should look at it later.

If I had experienced the same situation I'm sure I wouldn't have noticed that something was wrong. Kudos for noticing that and thank you for documenting it for everyone to understand :)

Re: Accidental Google Pixel Lock Screen Bypass

#49

Post by chrisfosterelli »

sunaurus wrote: post #10

I was under the impression that decrypting storage actually requires the passcode of the phone, but this bug makes it look like the device is able to decrypt itself without any external input. Does anybody know more context about this? What's the point of encryption if the device can just essentially backdoor decrypt itself?

The passcode is required to get access to anything the first time you start the phone, for the reason you mention, and after that the password is retained in the trusted execution environment. This way apps can continue to function in the background while the phone is locked and you can unlock with alternative methods like fingerprints or face recognition.
Post reply on HN