David Schütz, a cybersecurity researcher, inadvertently discovered a means to circumvent the lock screen on his fully updated Google Pixel 6 and Pixel 5 devices, allowing anybody with physical access to the smartphone to unlock it.
Bypassing the lock screen on Android smartphones is a straightforward five-step method that should only take a few minutes.
Google repaired the security flaw in the latest Android version issued last week, although it has been exploitable for approximately six months.
Inadvertent discovery
Schütz claims he found the weakness by accident after his Pixel 6 ran out of power, he proceeded to mistype his PIN three times, and then he used the PUK (Personal Unblocking Key) code to unlock his SIM card.
After unlocking the SIM and entering a new PIN, the device did not prompt him for the lock screen password, instead requesting a fingerprint scan.
For security reasons, Android smartphones usually request a lock screen password or pattern upon startup; thus, moving directly to fingerprint unlock was unusual.
The researcher kept investigating, and when he tried duplicating the weakness without rebooting the device, he realized it was feasible to skip the fingerprint as long as the owner unlocked it at least once since the reboot.
This security vulnerability has a broad impact, including all devices running versions of android 10, 11, 12, and 13 that have not applied the November 2022 patch.
Having physical access to a device is an essential requirement. However, the vulnerability can have serious consequences for persons with violent relationships, anyone under law enforcement investigation, owners of stolen electronics, and so on.
To gain unrestricted access to the victim's smartphone, all the attacker needs to do is utilize their own SIM card on the target device, input the incorrect PIN three times, and supply the PUK number.
Patching by Google
The problem is caused by the keyguard being incorrectly terminated following a SIM PUK unlock.
When Schütz input the right PUK number, two separate components called a dismiss function; one that constantly keeps tabs on the SIM state and another that handles PUKs. This resulted in the dismissal of the PUK security screen and the following security screen in the stack.
The user would go straight to the home screen if there were no additional security screens.
Google received the vulnerability report from Schütz in June 2022, and while they accepted it and gave it the CVE ID CVE-2022-20465, they didn't make a remedy available until November 7, 2022.
To solve this problem, Google has added a new argument to every "dismiss" call that specifies the security technique being used, allowing "dismiss" calls to be used to dismiss only certain security screens rather than the next one in the stack.
Despite Schütz's report being duplicated, Google made an exception and paid the researcher $70,000 for his discovery.
Android 10, 11, 12, and 13 users may fix this problem by installing the November 7, 2022, security update.
If this tip helps and you would like to donate click on the button. Thanks In Advance
________________________________________________________________________________________________________
"Fortune Favors, Who Value Time over Money!"
"TeQ I.Q. was the 1st IT Company to Deliver Cloud Solutions since 2003"
Tech issues taking up your Time?
"TeQ I.Q. Makes Your Technology Simple and Easy"
Do you have Tech Frustrations like your Computer, Internet, Phone, Cellphone, Camera, TV, Car?
"Buy a TV from us today and get the Best Price!
with Free Installation!"
"We Take Away Your Tech Frustrations and Give You the Free Time You Deserve!"
Call Robert to ask all your Technology questions.
We are giving a Free in Person TeQ Seminar at our office in La Mesa every Wednesday from 12pm-1pm and a Free TeQ Support Q&A from 1pm-2pm. Go to https://www.teqiq.com/events for our upcoming Events and https://www.teqiq.com/seminars for info on each Seminar.
For Free Consultation Call Now Robert Black at (619) 255-4180 or visit our website https://www.teqiq.com/
Chase Bank and Others Trust TeQ I.Q. with their IT and TeQnology so can you!
