A easy Android lock display bypass bug landed a researcher $70,000 • TechCrunch

Google has paid out $70,000 to a safety researcher for privately reporting an “unintended” safety bug that allowed anybody to unlock Google Pixel telephones with out realizing its passcode.

The lock display bypass bug, tracked as CVE-2022-20465, is described as an area escalation of privilege bug as a result of it permits somebody, with the machine of their hand, to entry the machine’s information with out having to enter the lock display’s passcode.

Hungary-based researcher David Schütz mentioned the bug was remarkably easy to use however took Google about 5 months to repair.

Schütz found anybody with bodily entry to a Google Pixel telephone may swap in their very own SIM card and enter its preset restoration code to bypass the Android’s working system’s lock display protections. In a weblog put up in regards to the bug, printed now that the bug is fastened, Schütz described how he discovered the bug unintentionally, and reported it to Google’s Android group.

Android lock screens let customers set a numerical passcode, password, or a sample to guard their telephone’s information, or nowadays a fingerprint or face print. Your telephone’s SIM card may additionally have a separate PIN code set to dam a thief from ejecting and bodily stealing your telephone quantity. However SIM playing cards have a further private unlocking code, or PUK, to reset the SIM card if the consumer incorrectly enters the PIN code greater than 3 times. PUK codes are pretty simple for machine house owners to acquire, usually printed on the SIM card packaging or immediately from the cell provider’s customer support.

Schütz discovered that the bug meant that coming into a SIM card’s PUK code was sufficient to trick his fully-patched Pixel 6 telephone, and his older Pixel 5, into unlocking his telephone and information, with out ever visually displaying the lock display. He warned that different Android gadgets may additionally be susceptible.

Since a malicious actor may deliver their very own SIM card and its corresponding PUK code, solely bodily entry to the telephone is required, he mentioned. “The attacker may simply swap the SIM within the sufferer’s machine, and carry out the exploit with a SIM card that had a PIN lock and for which the attacker knew the right PUK code,” mentioned Schütz.

Google will pay safety researchers as much as $100,000 for privately reporting bugs that might permit somebody to bypass the lock display, since a profitable exploit would permit entry to a tool’s information. The bug bounty rewards are excessive partially to compete with efforts by corporations like Cellebrite and Grayshift, which depend on software program exploits to construct and promote telephone cracking know-how to regulation enforcement businesses. On this case, Google paid Schütz a lesser $70,000 bug bounty reward as a result of whereas his bug was marked as a reproduction, Google was unable to breed — or repair — the bug reported earlier than him.

Google fastened the Android bug in a safety replace launched on November 5, 2022 for gadgets operating Android 10 via Android 13. You’ll be able to see Schütz exploiting the bug in his video beneath.