Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accidental Google Pixel Lock Screen Bypass

bugs.xdavidhu.me

Post reply on HN
Print view View original

61–70 of 475 posts

Re: Accidental Google Pixel Lock Screen Bypass

#61

Post by acdha »

eterm wrote: post #21

I wish closing things as "this is a duplicate" essentially required disclosure of the original (dupe) report. It may well be that it's a dupe, or it may be something that looks similar but not actually the same. And indeed as in this case it's only the follow up report that got the bug fixed. In this case it seems that contacts at google allowed them to escalate anyway and get it fixed. But so often and especially wi…

I’ve run into this with other vendors and really wished it’d get you CCed on updates so you didn’t have to ask for status periodically. It definitely doesn’t give a good impression when things drag out for aeons.

Re: Accidental Google Pixel Lock Screen Bypass

#63

Post by rkagerer »

endisneigh wrote: post #46
mschuster91 wrote: post #31

Earlier quoted context omitted.

> This was a serious feature deficit viz a viz the relevant iPhone at the time. IIRC, the iPhone uses not just a photo from the selfie cam, but adds infrared to construct a sort-of-3d-ish depth map of your face as well - that is what defeats a simple attempt at unlocking with photos. Now, the really interesting thing to research is if a silicone molded face mask could be used to fool the iPhone into unlocking. Photos…

Won’t work - https://9to5mac.com/2019/12/16/3d-mask/amp/ Muscle movement is also now necessary so it’s pretty difficult to circumvent

Betcha someone will make a silicone mask that twitches.

Re: Accidental Google Pixel Lock Screen Bypass

#64

Post by gcr »

tyingq wrote: post #16
sunaurus wrote: post #10

I was under the impression that decrypting storage actually requires the passcode of the phone, but this bug makes it look like the device is able to decrypt itself without any external input. Does anybody know more context about this? What's the point of encryption if the device can just essentially backdoor decrypt itself?

It didn't work on a fresh reboot, so presumably, it functioned like you're describing. But, when he swapped the sim live, without the reboot, the phone was already running with the key in memory.

On iPhone, keys are evicted from memory when the device is locked. Apps running behind the Lock Screen can only write files to special file inboxes (this is why the camera lets you take pictures while locked but doesn’t display earlier pictures, for example)

You’re telling me that android keeps keys in memory for its entire uptime?

Re: Accidental Google Pixel Lock Screen Bypass

#66

Post by gambiting »

lzooz wrote: post #57
lrvick wrote: post #43

Earlier quoted context omitted.

The security researchers only mistake was letting Google fart around for so long. You give them 90 days, then you go public. That is the policy Google Project Zero holds other companies to, so it is only fair to hold Google to the same standard. People using their device for high risk applications need to be informed in a timely manner, and Google needs to pay a reputational price for their negligence.

If you use a Pixel for high risk applications you are a bit at fault here

What a weird argument. So if the law enforcement of your country uses this technique to unlock your phone without your permission(or you know, some criminal does that), that's your fault for using a Pixel phone? You should have known better than you know, buying a phone from one of the largest software houses on the planet?

I smell a fair hint of victim blaming here.

Re: Accidental Google Pixel Lock Screen Bypass

#67

Post by lrvick »

lzooz wrote: post #57
lrvick wrote: post #43

Earlier quoted context omitted.

The security researchers only mistake was letting Google fart around for so long. You give them 90 days, then you go public. That is the policy Google Project Zero holds other companies to, so it is only fair to hold Google to the same standard. People using their device for high risk applications need to be informed in a timely manner, and Google needs to pay a reputational price for their negligence.

If you use a Pixel for high risk applications you are a bit at fault here

iOS has had many flaws this bad or worse, so what would you have people use?

I agree current gen smartphones should not trusted for high risk uses but the reality is, they are. There are staggering numbers of people using their phones for banking, crypto trading, or to transmit sensitive information that could collapse markets or start wars.

Also consider not all journalists or dissidents get a choice in what phone they can afford.

Security issues like this can be life or death, and security researchers must sometimes -force- companies to treat them as such.

Re: Accidental Google Pixel Lock Screen Bypass

#68

Post by marcinzm »

sschueller wrote: post #38
username_my1 wrote: post #32

Earlier quoted context omitted.

except apple takes bug fixes and security 100x more than google does. I remember the Android nightmares of Camera1 Camera2 CameraX APIs, then bluetooth all buggy implementation with years passing by and no decent solution in place. I don't remember a single big bug by iOS

From what I have heard, they may fix thing quickly but their bug bounty program is not liked and they skimp on paying higher payouts. Much more lukrative to sell your exploit on the black market.

This blog post doesn't make Google sound much better in that regard.

Re: Accidental Google Pixel Lock Screen Bypass

#69

Post by GiorgioG »

coldcode wrote: post #58

Given how much engineers make at Google after a long interview process to supposedly only get the best people, how significant the login system is to security, how "industry standard" the Google process is, it's not a bug that should have ever made it live. The bug fix show that the issue was clearly a case of a set of people not communicating well, code reviews being lax, and a general lack of understanding of how A…

I can't tell you how often I still see operating system level rotation bugs from iOS on my iPhone/iPad. Complexity kills.

Re: Accidental Google Pixel Lock Screen Bypass

#70

Post by acdha »

ApolloFortyNine wrote: post #30
endisneigh wrote: post #20

This is a great example of why you should use iOS. Most android devices do not receive security updates long enough to get this update. Since the author effectively tells you how to do it, all you need to do is find a pixel 4 or older and you’re golden.

Who knows how many bugs live in iOS as well. Security through obscurity (iOS is closed source) isn't usually considered that great a strategy. Besides the whole "can't install user software" issue.

The number of long-running bugs which have been found in popular open source projects suggests that “many eyes make all bugs shallow” should be remembered as an amusing bit of 90s trivia like Swatch Internet Time.

What seems to matter more is how many auditors are actually digging in and how aggressively secure coding practices are applied. It certainly doesn’t seem like there’s a big difference between the two in terms of security but Android has more people using old software because their manufacturer didn’t want to ship an update.

Post reply on HN