David Schütz, a cybersecurity researcher, inadvertently discovered a means to circumvent the lock screen on his fully updated Google Pixel 6 and Pixel 5 devices, allowing anybody with physical access to the smartphone to unlock it.
Bypassing the lock screen on Android smartphones is a straightforward five-step method that should only take a few minutes.
Google repaired the security flaw in the latest Android version issued last week, although it has been exploitable for approximately six months.
Inadvertent discovery
Schütz claims he found the weakness by accident after his Pixel 6 ran out of power, he proceeded to mistype his PIN three times, and then he used the PUK (Personal Unblocking Key) code to unlock his SIM card.
After unlocking the SIM and entering a new PIN, the device did not prompt him for the lock screen password, instead requesting a fingerprint scan.
For security reasons, Android smartphones usually request a lock screen password or pattern upon startup; thus, moving directly to fingerprint unlock was unusual.
The researcher kept investigating, and when he tried duplicating the weakness without rebooting the device, he realized it was feasible to skip the fingerprint as long as the owner unlocked it at least once since the reboot.
This security vulnerability has a broad impact, including all devices running versions of android 10, 11, 12, and 13 that have not applied the November 2022 patch.
Having physical access to a device is an essential requirement. However, the vulnerability can have serious consequences for persons with violent relationships, anyone under law enforcement investigation, owners of stolen electronics, and so on.
To gain unrestricted access to the victim's smartphone, all the attacker needs to do is utilize their own SIM card on the target device, input the incorrect PIN three times, and supply the PUK number.
Patching by Google
The problem is caused by the keyguard being incorrectly terminated following a SIM PUK unlock.
When Schütz input the right PUK number, two separate components called a dismiss function; one that constantly keeps tabs on the SIM state and another that handles PUKs. This resulted in the dismissal of the PUK security screen and the following security screen in the stack.
The user would go straight to the home screen if there were no additional security screens.
Google received the vulnerability report from Schütz in June 2022, and while they accepted it and gave it the CVE ID CVE-2022-20465, they didn't make a remedy available until November 7, 2022.
To solve this problem, Google has added a new argument to every "dismiss" call that specifies the security technique being used, allowing "dismiss" calls to be used to dismiss only certain security screens rather than the next one in the stack.
Despite Schütz's report being duplicated, Google made an exception and paid the researcher $70,000 for his discovery.
Android 10, 11, 12, and 13 users may fix this problem by installing the November 7, 2022, security update.
