Hacker Rewarded $70,000 for Finding Way to Bypass Google Pixel Phones' Lock Screens
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-20465 | In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass due to a logic error in the code. In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-218500036 NVD description · AI analysis pending | 4.6 | <1% |
| — |
Full article346 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananNov 10, 2022
Google has resolved a high-severity security issue affecting all Pixel smartphones that could be trivially exploited to unlock the devices.
The vulnerability, tracked as CVE-2022-20465 and reported by security researcher David Schütz in June 2022, was remediated as part of the search giant's monthly Android update for November 2022.
"The issue allowed an attacker with physical access to bypass the lock screen protections (fingerprint, PIN, etc.) and gain complete access to the user's device," Schütz, who was awarded $70,000 for the lock screen bypass, said in a write-up of the flaw.
The problem, per the researcher, is rooted in the fact that lock screen protections are completely defeated when following a specific sequence of steps -
- Supply incorrect fingerprint three times to disable biometric authentication on the locked device
- Hot swap the SIM card in the device with an attacker-controlled SIM that has a PIN code set up
- Enter incorrect SIM pin thrice when prompted, locking the SIM card
- Device prompts user to enter the SIM's Personal Unlocking Key (PUK) code, a unique 8-digit number to unblock the SIM card
- Enter a new PIN code for the attacker-controlled SIM
- Device automatically unlocks
This also means that all an adversary needs to unlock a Pixel phone is to bring their own PIN-locked SIM card and is in possession of the card's PUK code.
"The attacker could just swap the SIM in the victim's device, and perform the exploit with a SIM card that had a PIN lock and for which the attacker knew the correct PUK code," Schütz said.
An analysis of the source code commits made by Google to patch the flaw shows that it's caused by an "incorrect system state" introduced as a result of wrongly interpreting the SIM change event, causing it to entirely dismiss the lock screen.
"I was not expecting to cause this big of a code change in Android with this bug," Schütz concluded.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/11/hacker-rewarded-70000-for-finding-way.html