Good reason to not disclose to Google.
Instead, you should sell the exploit on the exploit dealers sites. This is easily worth $300-500k
But not now. And you have the 'privilege' of being dicked around with people googling you.
Accidental Google Pixel Lock Screen Bypass
81–90 of 475 posts
Re: Accidental Google Pixel Lock Screen Bypass
#82Given how much engineers make at Google after a long interview process to supposedly only get the best people, how significant the login system is to security, how "industry standard" the Google process is, it's not a bug that should have ever made it live. The bug fix show that the issue was clearly a case of a set of people not communicating well, code reviews being lax, and a general lack of understanding of how A…
[deleted]
Re: Accidental Google Pixel Lock Screen Bypass
#83Earlier quoted context omitted.
The security researchers only mistake was letting Google fart around for so long. You give them 90 days, then you go public. That is the policy Google Project Zero holds other companies to, so it is only fair to hold Google to the same standard. People using their device for high risk applications need to be informed in a timely manner, and Google needs to pay a reputational price for their negligence.
If you use a Pixel for high risk applications you are a bit at fault here
I disagree with this. There isn't a consumer-level alternative to the security provided by a pixel if you want to use a cell phone right now. I guess you can argue that the iphone is better, but without a specific threat model to discuss, it's like arguing mountain dew is not healthy so you should drink dr. pepper.
Re: Accidental Google Pixel Lock Screen Bypass
#84I can't believe this is not a "drop everything and get it fixed ASAP" bug. This makes me think there's probably tons of other similar bugs out there being exploited right now even with disclosure.
[deleted]
Re: Accidental Google Pixel Lock Screen Bypass
#85Earlier quoted context omitted.
> Despite having all the hardware on the phone Did Pixel phones really have a frontal lidar?
Pixel 4 had dedicated hardware (project Soli)
Incidentally, I said to myself I would buy a Pixel 5 if it had Soli as well because it would show that Google was becoming serious about supporting features for more than 1 generation.
Predictably, I never bought a Pixel 5 or 6 or 7.
Re: Accidental Google Pixel Lock Screen Bypass
#86Earlier quoted context omitted.
It didn't work on a fresh reboot, so presumably, it functioned like you're describing. But, when he swapped the sim live, without the reboot, the phone was already running with the key in memory.
On iPhone, keys are evicted from memory when the device is locked. Apps running behind the Lock Screen can only write files to special file inboxes (this is why the camera lets you take pictures while locked but doesn’t display earlier pictures, for example) You’re telling me that android keeps keys in memory for its entire uptime?
> You’re telling me that android keeps keys in memory for its entire uptime?
Yes. I've known that for quite some time, and yet I keep forgetting considering how stupid this feels [1] . Google provides "lockdown" button which is supposedly more secure (I think it's recommended for journalists?)... Well it doesn't evict keys either. Only eviction is to reboot.
[1] It feels stupid because there had been a LOT of work to move from FDE to FBE and to allow two states of data encryption and telling apps to support both of them. Doing all this work just to be able to store incoming SMS and to display wallpaper on first lockscreen...?
Re: Accidental Google Pixel Lock Screen Bypass
#87I can't believe this is not a "drop everything and get it fixed ASAP" bug. This makes me think there's probably tons of other similar bugs out there being exploited right now even with disclosure.
There's exactly one drop everything and get it fixed ASAP bug at Google - something broke the ad platform.
If its not a "Bank error in your favor - collect $200" error that favors Google.
Re: Accidental Google Pixel Lock Screen Bypass
#88Earlier quoted context omitted.
It didn't work on a fresh reboot, so presumably, it functioned like you're describing. But, when he swapped the sim live, without the reboot, the phone was already running with the key in memory.
On iPhone, keys are evicted from memory when the device is locked. Apps running behind the Lock Screen can only write files to special file inboxes (this is why the camera lets you take pictures while locked but doesn’t display earlier pictures, for example) You’re telling me that android keeps keys in memory for its entire uptime?
What do Windows/Mac/Linux do?
Re: Accidental Google Pixel Lock Screen Bypass
#89The discussion on race conditions at the end is an important one, and IMO the bugfix is a bandage at best: the notion of anything accessing the “current” object after any kind of delay, especially in an event handler, when there is any chance the thing is not a singleton, is a recipe for disaster. In this case, dismissing the “current” security code screen was a supported API surface and that should set off all the r…
Agreed. The fixed logic, at least judging by the commit message, still feels very shaky on correctness grounds ("if we are dismissing something that doesn't seem to be right, ignore it").
Since they're rewriting code and changing method signatures anyway, I would prefer they got rid of the notion of "currently visible screen" and made sure that all dismiss() calls have a unique pointer or token pointing to what exactly is being dismissed. If this was my codebase, their approach would give me all sorts of bad vibes about additional problems lurking deeper.
The whole process and the nature of the fix doesn't inspire a lot of confidence in the security of Pixel/Android in general.
Re: Accidental Google Pixel Lock Screen Bypass
#90Good reason to not disclose to Google. Instead, you should sell the exploit on the exploit dealers sites. This is easily worth $300-500k But not now. And you have the 'privilege' of being dicked around with people googling you.
[deleted]