Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accidental Google Pixel Lock Screen Bypass

bugs.xdavidhu.me

Post reply on HN
Print view View original

401–410 of 475 posts

Re: Accidental Google Pixel Lock Screen Bypass

#401

Post by Twisell »

izacus wrote: post #226
tinus_hn wrote: post #211

Earlier quoted context omitted.

If you unlock the screen using Face ID the OS gets the keys from the Secure Enclave which, depending on the model, does the face recognition itself or using the normal processor in some kind of secure way. Just like if you unlock the phone using the pin code, the OS gets the key from the Secure Enclave which makes sure it’s not easy to brute force. The PIN code is not the key itself of course. The only key that somet…

Yes, and that's how Pixels work as well. The condition in question here is of course when the secure enclave releases the keys and mounts the storage.

You can have look at this document to answer that : https://help.apple.com/pdf/security/en_US/apple-platform-sec...

From what I gather the more secured keys should be discarded 10 seconds after lock screen event. Lower security keys stay in memory to allow background activity.

Encryption on ios, if i understand correctly, is on a per file basis. There is thus no "mount" event to look for and it should provide no value to use a less secured key if you do not intend to run on background because decryption is supposed to happen on the fly.

PS: Also if I remember correctly pressing down the emergency sequence (holding power + volume up) discard ALL keys instantly and unlock require the passphrase as if you just rebooted. Emergency call don't need to be issued just initiated (must hold 10 sec or confirm on screen to make the actual emergency call).

Re: Accidental Google Pixel Lock Screen Bypass

#402

Post by AtNightWeCode »

Nicely written. I have found my Samsung phone unlocked for no reason so many times I can't remember anymore. I am sure there is some way to use the emergency call or the ICE feature to bypass the lock screen. There seems like these features randomly gets activated while the phone is in the pocket as well.

Re: Accidental Google Pixel Lock Screen Bypass

#403

Post by [deleted] »

metacritic12 wrote: post #400

Terrible response by Google to this. Basically it seems like their bureaucracy is structured so that no one has an incentive to actually address this. Everyone at the company acted like they would rather this issue not even exist, rather that address a critical flaw that makes locking essentially not work on the Pixel. This gives us a look under the cover of what's important at Google, and it seems like security is a…

[deleted]

Re: Accidental Google Pixel Lock Screen Bypass

#404

Post by woojoo666 »

jwr wrote: post #381

I have an obsession with classifying software bugs into general categories, looking for the "root cause", or more constructively, for a way to avoid entire classes of bugs altogether. I've been doing that for more than 20 years now. This bug, if you look into the fix, falls into my "state transition" category. You can (and should) model large parts of your software as a state machine, with explicit transitions and in…

Another way to look at it is, since the bug is from a race condition, modeling your program after functional programming would minimize these bugs

Re: Accidental Google Pixel Lock Screen Bypass

#405

Post by hadlock »

sn_master wrote: post #341

This is very worrying. I have two old Pixels (2 and 4) with plenty of personal data, and none have been updated for years now. I am sure other people too keep their old phones around and won't be getting updated either.

This only applies to phones who remain continuously powered on and still retain the decryption key in memory. It's possible you turn on your old, unused phone, unlock it (putting the key in memory), and plug it in for years but the number of phones in this state are probably vanishingly small.

Re: Accidental Google Pixel Lock Screen Bypass

#406

Post by woojoo666 »

system2 wrote: post #386
bluocms wrote: post #7

How come the security model is so basic? I even think they should dismiss modal by id instead of type. As this is a highly sensitive part, I think stacking lock screens on top of the unlocked menu leaves the door open for many bugs that could unlock your device. The unlocked menu should be locked at all times, and use a flag to monitor if it’s locked/unlocked, and only flip the flag when you unlock with biometrics or…

It is android.

To be fair, we only know the source of the bug since it's open source. With iOS, we have no idea how bad the code is behind the scenes

Re: Accidental Google Pixel Lock Screen Bypass

#407

Post by hadlock »

h43z wrote: post #245

So basically google wanted to give this guy nothing. Then he set a hard deadline for disclosure and google managed to buy him for 70k so they could stick with their own deadline.

It would not surprise me if in some cases, google runs the exploit up the tree to the NSA to see if they're actively using this for matters of national security, then slow-walk the patch to release. Given how easy the exploit is (no software needed, no special equipment beyond a paper-clip), would not surprise me if this has been in wide use for several years now by various groups.

Re: Accidental Google Pixel Lock Screen Bypass

#408

Post by yreg »

Sophira wrote: post #390
h43z wrote: post #245

So basically google wanted to give this guy nothing. Then he set a hard deadline for disclosure and google managed to buy him for 70k so they could stick with their own deadline.

According to the article, the reporter had already decided before the bounty had been set that they would wait for the fix: > I also decided (even before the bounty) that I am too scared to actually put out the live bug and since the fix was less than a month away, it was not really worth it anyway.

According to the bug thread transcript Google have not yet known he's not going to disclose in October when they offered the 70k.

https://feed.bugs.xdavidhu.me/bugs/0016

Re: Accidental Google Pixel Lock Screen Bypass

#409

Post by bornfreddy »

Gasp0de wrote: post #268
laurencei wrote: post #127

Earlier quoted context omitted.

I suppose the risk is people could 'game' the system. Person A finds the issue, reports it. Then Person A secretly tells Person B about it (with no apparent connection), and Person B reports the same issues a few weeks later, but with apparent different code/description to look ever so slightly different.

Split the reward between everyone who reported it. It's even still kind of fair: The more people find it the easier it was to find.

Of course, then when A and B independently find a bug, B can enlist C, D and E, thus taking 80% instead of 50% of the bounty.

No system is perfect.

Re: Accidental Google Pixel Lock Screen Bypass

#410

Post by bornfreddy »

dyingkneepad wrote: post #333
_kbh_ wrote: post #185

Earlier quoted context omitted.

LEO already have access to locked phones via stuff like GrayKey. https://www.grayshift.com/graykey/

Why don't Google and Apple buy this product then proceed to analyze and close all holes?

If I had to guess: not everyone can buy this software and A/G are not wanted by the sellers. Even the usual customers (law enforcement) are not very likely to pass exploits to them, because their work would become more difficult.
Post reply on HN