Accidental Google Pixel Lock Screen Bypass
bugs.xdavidhu.me
Accidental Google Pixel Lock Screen Bypass
1–10 of 475 posts
Re: Accidental Google Pixel Lock Screen Bypass
#2A fun and interesting read. But it is frustrating to hear that such a major security bug was ignored until a happenstance meeting with Google engineers.
Re: Accidental Google Pixel Lock Screen Bypass
#3Have you tested this on other brands?
Re: Accidental Google Pixel Lock Screen Bypass
#4Given the bug was already reported (and even more ignored) it seems like the $70,000 was really a “you made us do our jobs” fee.
Re: Accidental Google Pixel Lock Screen Bypass
#5Seems to me like this impacts not only Pixel devices but all Android devices?
Patch was to AOSP: https://github.com/aosp-mirror/platform_frameworks_base/comm...
I don't have a locked SIM handy, but can someone please test on their non-Pixel device and confirm?
Re: Accidental Google Pixel Lock Screen Bypass
#6Very interesting. To summarise, I think the issue is that the phone gets itself into a state of waiting for a locked SIM to release itself before it unlocks the phone - the problem being the attacker could have their own pre-locked SIM they can hotswap in that of course they know the code for, and this will erroneously also unlock the phone.
Re: Accidental Google Pixel Lock Screen Bypass
#7How come the security model is so basic?
I even think they should dismiss modal by id instead of type.
As this is a highly sensitive part, I think stacking lock screens on top of the unlocked menu leaves the door open for many bugs that could unlock your device.
The unlocked menu should be locked at all times, and use a flag to monitor if it’s locked/unlocked, and only flip the flag when you unlock with biometrics or with password.
If the flag is locked, then the whole screen is black and can’t have any interactivity via touch, mouse, kw…
This way is more robust, so even if you manage to bypass the stack of lock screens, you end up with main menu locked.
Re: Accidental Google Pixel Lock Screen Bypass
#8> The bug just got fixed in the November 5, 2022 security update.
Lovely. My Pixel 4 got it's last update in Oct.
Re: Accidental Google Pixel Lock Screen Bypass
#9[deleted]
Re: Accidental Google Pixel Lock Screen Bypass
#10I was under the impression that decrypting storage actually requires the passcode of the phone, but this bug makes it look like the device is able to decrypt itself without any external input.
Does anybody know more context about this? What's the point of encryption if the device can just essentially backdoor decrypt itself?