Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accidental Google Pixel Lock Screen Bypass

bugs.xdavidhu.me

Post reply on HN
Print view View original

411–420 of 475 posts

Re: Accidental Google Pixel Lock Screen Bypass

#411

Post by im3w1l »

jwr wrote: post #381

I have an obsession with classifying software bugs into general categories, looking for the "root cause", or more constructively, for a way to avoid entire classes of bugs altogether. I've been doing that for more than 20 years now. This bug, if you look into the fix, falls into my "state transition" category. You can (and should) model large parts of your software as a state machine, with explicit transitions and in…

I think the root issue is one of which state is the default one. In Android the logged-in state is the default one, and the logged-out state is constructed by taking the logged-in state and essentially hiding it behind a modal.

The issue with this is that systems have a tendency to return to their default state. If the modal is dismissed or has a bug that makes it crash or has a memory corruption, or any number of things then the system will return to the default state.

I would turn it upside down, and let the logged out state be the default one. The logged-in state is then a lockscreen that is hidden behind a session. If the session dies you are back at the lock screen. The lock screen can't be dismissed because it's always there. If the lockscreen crashes the phone locks up completely because there is nothing else there to show.

It's acceptable for failures and exceptions to decrease privilege (boot you out), but they must never increase it.

Edit: Ideally the lockscreen should also run with reduced privileges so that it literally can't start a session even if it wants to, except indirectly by supplying a password to some other system.

Re: Accidental Google Pixel Lock Screen Bypass

#412

Post by SCdF »

This is where I find out my otherwise completely functioning Pixel 3a no longer gets security updates, as of May.

I knew and accepted that it wouldn't get new features and major android versions, but to not even get security updates, after only three years?

So my options are: live with the piece of technology in my life that is both the most vunerable to physical security issues and has the widest access to my critical information no longer getting active security updates, attempt to root it and install my own build (is cyanogenmod still a thing?), or throw a working piece of complex technology in the trash?

Amazing

Re: Accidental Google Pixel Lock Screen Bypass

#414

Post by jbverschoor »

SCdF wrote: post #412

This is where I find out my otherwise completely functioning Pixel 3a no longer gets security updates, as of May. I knew and accepted that it wouldn't get new features and major android versions, but to not even get security updates, after only three years? So my options are: live with the piece of technology in my life that is both the most vunerable to physical security issues and has the widest access to my critic…

So you migrate to Apple

Re: Accidental Google Pixel Lock Screen Bypass

#415

Post by bornfreddy »

bredren wrote: post #382
djmips wrote: post #363

Do you think there was an previous report for which this was a duplicate or were they just trying to get away without paying?

This may be a stretch but I could see the original report coming from an intelligence service. The report might be accompanied by a request to hold off on patching it due to active use. This would explain the desire to wait on G's side, and why it would not explain the prior report.

And also why they patched it only when faced with exposure.

Re: Accidental Google Pixel Lock Screen Bypass

#416

Post by jquery »

daneel_w wrote: post #324
jquery wrote: post #290

Earlier quoted context omitted.

This sounds like a UI race condition and actually gives me more confidence in the iPhone (unlike the Pixel, the unlock state isn’t tied to UI elements). Unless of course you can do this long after it locks…

The issue is that it happens after the phone has locked, not that the PIN dialog happens to briefly flash before being bypassed.

Very strange. I’ve always used Touch ID when available so I can’t say I’ve experienced the issue myself.

Re: Accidental Google Pixel Lock Screen Bypass

#417

Post by kaimalcolm »

albertzeyer wrote: post #176
kaimalcolm wrote: post #24

Appalling handling on Google’s end here. The duplicate issue part I can understand, but why should it take two reports of a critical vulnerability to take action? Surely when the first one comes through it’s something you jump on, fix and push out ASAP, not give delay to the point where a second user can come along, find the bug, and report it. The refactor that’s mentioned towards the end of the article is great, bu…

You can read in the conversation that Google was not able to reproduce it the first time the bug was submitted: > The same issue was submitted to our program earlier this year, but we were not able to reproduce the vulnerability. When you submitted your report, we were able to identify and reproduce the issue and began developing a fix. I wonder if it really was the same bug or what they did wrong to reproduce it. Or…

Then if that’s the case, the author should have been paid a full payout, not a “thanks for making us fix this” payment.

Re: Accidental Google Pixel Lock Screen Bypass

#418

Post by SCdF »

jbverschoor wrote: post #414
SCdF wrote: post #412

This is where I find out my otherwise completely functioning Pixel 3a no longer gets security updates, as of May. I knew and accepted that it wouldn't get new features and major android versions, but to not even get security updates, after only three years? So my options are: live with the piece of technology in my life that is both the most vunerable to physical security issues and has the widest access to my critic…

So you migrate to Apple

That would be the "throw a working piece of complex technology in the trash" option, yes

Re: Accidental Google Pixel Lock Screen Bypass

#419

Post by rerx »

SCdF wrote: post #412

This is where I find out my otherwise completely functioning Pixel 3a no longer gets security updates, as of May. I knew and accepted that it wouldn't get new features and major android versions, but to not even get security updates, after only three years? So my options are: live with the piece of technology in my life that is both the most vunerable to physical security issues and has the widest access to my critic…

There is LineageOS now, https://wiki.lineageos.org/devices/sargo/

The most recent Pixels get a few extra years of only security updates after regular updates run out. So at least they have improved the policy somewhat now.

It would be great if Google went ahead and fixed this problem in particular for more devices, though.

Re: Accidental Google Pixel Lock Screen Bypass

#420

Post by easrng »

izacus wrote: post #114
gcr wrote: post #64

Earlier quoted context omitted.

On iPhone, keys are evicted from memory when the device is locked. Apps running behind the Lock Screen can only write files to special file inboxes (this is why the camera lets you take pictures while locked but doesn’t display earlier pictures, for example) You’re telling me that android keeps keys in memory for its entire uptime?

That's not really true at all - you can of course unlock your iPhone without entering PIN for every screen lock which should give you a clue that keys for disk encryption generally aren't purged when iPhone is locked. Some keys are, but not the ones that are the issue here. I've even seen conditions where iOS devices reboot and still retain keys.

You probably were seeing a respring (restart of the UI processes) not a reboot.
Post reply on HN