ClickCease Hackers exploit security flaw in Google Pixel lock screen
Cybersecurity News,

Hackers exploit security flaw in Google Pixel lock screen

November 22, 2022
Hackers exploit security flaw in Google Pixel lock screen

A security researcher, David Schütz has received a $70,000 bug bounty after he accidentally discovered a Google Pixel lock-screen bypass hack that solved a serious security problem on all Pixel smartphones that could easily be exploited to unlock the devices.

Schütz discovered the vulnerability, which allowed an attacker to unlock any Google Pixel phone without knowing the passcode. Google fixed the problem, known as CVE-2022-20465, with an update in November, allowing Schütz to publish his findings.

Schütz discovered the problem by chance when he forgot the PIN code of his Pixel phone and had to enter the PUK code to gain access. He noticed anomalies in the lock screen that were presented to him after the successful completion of the process. After accepting his finger, the device crashed with a weird “Pixel is starting…” message, which Schütz addressed with a forced reboot.

The problem per Schütz, is rooted in the fact that lock screen protection is completely turned off if you follow a certain sequence of steps.

First, enter a false fingerprint three times to disable biometric authentication on the locked device. Then, replace the SIM card of the device with a SIM controlled by the attacker that has a PIN code set up. Then, enter a false SIM pin three times to lock the SIM card. Then, the device asks the user to enter the SIM Personal Unlocking Key (PUK) code, a unique eight-digit number to unlock the SIM card. Then, enter a new PIN code for the SIM controlled by the attacker and the device will be automatically unlocked.

Schütz was presented with his unlocked home screen after following this sequence, before entering the PUK code and selecting a new PIN, he realized that he had completely bypassed the lock screen on the fully patched Pixel 6 and Pixel 5.

The sources for this piece include an article in TheHackerNews.

Summary
Hackers exploit security flaw in Google Pixel lock screen
Article Name
Hackers exploit security flaw in Google Pixel lock screen
Description
A security researcher, David Schütz has received a $70,000 bug bounty after he discovered a Google Pixel lock-screen bypass hack.
Author
Publisher Name
TuxCare
Publisher Logo

TuxCare can help you reduce your risk window to data exfiltration and other cyber security threats.

TALK TO A CYBERSECURITY EXPERT

Expert knowledge of Linux security tips,
live patching education, and Cybersecurity news.

Stay updated with the latest news and announcements from TuxCare.com

Related Articles

Bahamut deploys fake VPN apps...

ESET researchers discovered an ongoing campaign by the Bahamut APT...

December 9, 2022

Windows Server updates causes LSASS...

A memory leak bug on Local Security Authority Subsystem Service...

December 8, 2022

1,650 malicious Docker Hub images...

After discovering malicious behaviors in 1,652 of 250,000 unverified Linux...

December 7, 2022

Arm’s Mali GPU driver flaws...

Despite fixes released by the chipmaker, a set of five...

December 6, 2022

RansomExx malware offers new features...

The APT group DefrayX has launched a new version of...

December 5, 2022

DuckDuckGo launches beta version of...

DuckDuckGo, a privacy-focused search engine, has added an App Tracking...

December 2, 2022

Resources

State of Enterprise Linux Cybersecurity ... Read More State of Enterprise Linux Cybersecurity ...
Dangerous remotely exploitable vulnerability ... Read More Dangerous remotely exploitable vulnerability ...
Securing confidential research data ... Read More Securing confidential research data ...
State of Enterprise Vulnerability Detection ... Read More State of Enterprise Vulnerability Detection ...
Demand for Rapid Risk Elimination for ... Read More Demand for Rapid Risk Elimination for ...
TuxCare Free Raspberry Pi Patching Read More TuxCare Free Raspberry Pi Patching