13 ms·
To hack an Android phone, just type in a really long password
- sharmadwivid 11y agoNot working with my cell phone
- SixSigma 11y agoPerhaps your computer doesn't get overloaded
- tombrossman 11y agoNote this is for password-protected phones only, PIN and pattern protected phones not affected. The original vulnerability is here, for those preferring to skip CNN and go straight to it: http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen-bypass/ http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen-...
- pilif 11y agoHow ironic that this bug affects the only really secure locking method. Neither the pattern nor the pin are really safe to protect a device as both are easily snoopable.
- fredley 11y ago> only really secure Security is not an absolute, and there is no such thing as "really/totally/completely secure". The different locking methods allow you to strike a balance between security and convenience that's appropriate for you. All of these are useless against a determined attacker, for a given level of 'determined'.
- watty 11y agoI don't think he was saying it was "absolutely" secure or totally or completely. Just that it was the "more secure" method, which is not an absolute. There may not be an absolute in security but there are definitely differences in types of security.
- raverbashing 11y agoEven more ironic seeing how Java was supposed to not allow for buffer overflows
- Vexs 11y agoImo the pattern lock is really secure if you make it hidden at lockscreen.
- madeofpalk 11y agoRecently there was a report around the pattern lock being the least secure and having the least amount of variation between passwords. Edit: Unfortunately I can't find the specific study I was looking for, so I'll have to add my own [citation needed]
- aroch 11y agoYou're probably think of this Ars piece: http://arstechnica.com/security/2015/08/new-data-uncovers-the-surprising-predictability-of-android-lock-patterns/ http://arstechnica.com/security/2015/08/new-data-uncovers-th...
- Vexs 11y agoOh, no doubt. Realistically I don't expect my phone to be secure from the lockscreen, it's more to keep pests out. Anything secure is from full disk encryption, passworded SU, etc. As far as person-looking-over-you protection, they're not bad.
- deleted 11y ago[deleted]
- gambiting 11y agoWell, internally the pattern password is literally stored as numbers, just like the pin. So If you go top right to middle right then to middle, then to bottom middle, your pattern will be saved as 3658. It's less secure than a pin, because obviously with a pattern lock a 3 can only be followed by a 2,5 or 6, and no number can repeat, so it's easier to crack than a pin.
- drzaiusapelord 11y agoMy pattern left a trail on my screen pretty much telling you my password. You'd have to guess on the direction a couple times, but you'd get it fairly quickly. I think the pattern lock is really just a way to keep kids off your phone. Greasy fingers on glass are way too telling.
- ignoramous 11y agoPreviously, any crash in the Keyguard (which used to reside in the same process boundary as the system_server) would have taken down the OS, and a (soft) reboot would have ensued. Now that the Keyguard runs in its own process, any crashes now only gets rid of the Keyguard window and exposes whatever window is behind it (usually a launcher window). I wonder if the actual fix is to have the "watchdog" ping the Keyguard's process for a heartbeat like it does so with other services within the system_server... That way, any flaw / crash in Keyguard and you essentially loose access to the OS too (until it come backs up from the reboot, and starts from a clean slate).
- quotemstr 11y agoNT has a neat feature for essential processes: you can tell the kernel, "if I ever exit, for whatever reason, panic the system and reboot immediately". There's little room for error with a system like that. It wouldn't be that hard to implement this feature in Linux too. (Of course, you need to have special privileges to mark your process as critical.)
- akx 11y agoI could see malware authors making use of that feature. Any documentation for it?
- seba_dos1 11y agoI suppose that if you have permissions to use that feature, you could already take the system down with millions of other ways.
- ultramancool 11y agohttps://msdn.microsoft.com/en-us/library/windows/desktop/aa373646%28v=vs.85%29.aspx https://msdn.microsoft.com/en-us/library/windows/desktop/aa3... Of course, it's possible to excise such processes via patching or with a debugger.
- jschwartzi 11y ago
- mehrdada 11y agoThis can happen only because of a design flaw in the security architecture of Android (L). Unlike iOS and like traditional PCs, the disk encryption key is always in memory when the device is booted and nothing is really protected if you get a device in that state. It's an all-or-nothing proposition. On iOS, there are different encryption keys that are used to protect different classes of information. Specifically, when an iOS device is locked, the operating system loses a key that can decrypt files that are of a certain protection class that are not supposed to be readable when the device is locked. Only by entering the password when unlocking the device (or reloading it from Touch ID memory), that key can be derived again. The effect is, for example, all your mail can be protected and rendered unreadable while the device is locked. With this security architecture, no bug in the password "gatekeeper UI" can lead to you being able to read the protected information if the device gets locked successfully.
- devit 11y agoYou can do that on PC by hibernating instead of locking the screen (assuming it works on the OS and hardware being used) and then rebooting instead of shutting down after hibernation.
- mehrdada 11y agoIf you do that, you'll lose 100% of your PC's functionality, whereas iOS is quite useful in locked mode. With some neat tricks, it even fetches new mail for you, for instance: basically it encrypts new messages by encrypting them with a public key whose private key is encrypted and the key is not available while the device is locked[+]. A hibernated PC cannot do this and lots more. [+]: technically, it generates a new AES key, encrypts the message under it, encrypts that key under a key derived from ECDH over Curve25519 with the system public key (whose private key is encrypted and inaccessible while locked) and saves the encrypted file and the wrapped key somewhere to be decrypted when it gets unlocked and gets rid of the AES key.
- devit 11y agoThat's not as secure as hibernation, because someone who can break into the running device can at least read all your new mail and if they aren't using an ad-hoc e-mail protocol or implemented it carelessly also read all mail and probably get the e-mail username and password too. This also only really works for software specifically designed for this mode. EDIT: it can actually be mostly secure if the client public key is sent before locking and then the encryption is done by the server: the attacker would only learn the number and timing of new messages and their size (assuming an ad-hoc protocol and very carefully implemented software). It's also sort of possible to do it with generic software by simply dumping HTTPS TCP traffic to disk and decoding it once the system is unlocked (although it allows a MITM to fill up your disk unless the ciphersuite allows authentication with a key that doesn't allow decryption).
- 2III7 11y agoNot working on my S6. Can't paste nothing on password entry dialog.
- masklinn 11y agoIt was fixed in 5.1.1 build LMY48M (http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen-bypass/ http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen-...)
- chx 11y agoIt's interesting how most Nexus devices only have a LMY48M image https://developers.google.com/android/nexus/images?hl=en https://developers.google.com/android/nexus/images?hl=en but the razorg skipped that and has LMY48P (which I flashed yesterday, phew!). Also, the 2012 Nexus 7 is still stuck at LMY47V.
- nisdec 11y agoSummary: 1. Only affects stock Android 2. Only works with password protection (PIN, pattern = OK) 3. Already patched
- stouset 11y ago"Already patched" isn't really as meaningful on Android as it is on, e.g., iOS where the average user can expect to (and frequently does) update their operating system. How many phones are still vulnerable to StageFright?
- userbinator 11y ago> 1. Only affects stock Android 5.x <= 5.1.1
- CervezaPorFavor 11y agoYeah. It doesn't work on my Note 3. Samsung disabled copy & paste in the Emergency Call dialer. The author clearly didn't do his research, simply assuming that the vulnerability affects all Android devices: > But there's no telling when it'll reach Android devices made by Samsung, LG and others. Blame the Android's fractured updating system, which is slowed down by phone manufacturers and cellphone network carriers.
- paws 11y agoOS X had a curiously similar screensaver vulnerability back in the early days. On 10.2.6 and earlier, attempting to submit a very long string (>65,537 characters if memory serves) into the screensaver password prompt would crash the screensaver and drop to the desktop. Making exploitation much easier was how around the same time Cocoa widgets got emacs-style bindings like ctrl-k, ctrl-y, ctrl-a. Through combining these shortcuts an attacker could quickly and exponentially increase the input string length. I never saw it documented online but I remember applying this same trick to logonwindow and OS X dropping into the so-called 'secret >console mode' -- full screen terminal, Linux-style. Background: https://www.securemac.com/macosx-screensaver-security.php https://www.securemac.com/macosx-screensaver-security.php
- mahouse 11y agoI seriously would like to know why did not they implement a limit of characters on that field.
- billpg 11y ago"But phones will remain vulnerable until they're updated with the latest software patch." So never then.
- kozukumi 11y agoThis is the number one problem I have with Android. Once I buy an Android phone I pretty much expect 6 months of updates. Maybe longer if it is a really big bug. Sure some OEMs have made "promises" to provide 2 years of updates but that updates don't come out all that quickly, often several months after it hits the main AOSP line. If you want an iOS like experience with Android you have to buy a Nexus phone of which the Nexus 6 sucked balls due to its size. I wish Google hadn't killed the Play Edition phones. I would love a choice of phones running stock Android, maybe with a few extra, optional, apps from the OEM similar to what Motorola does. A Galaxy S6 running stock Android with a guarantee of update within 2 weeks of it hitting a Nexus would be my perfect phone.
- dzhiurgis 11y agoWhat is it with Android that it can't work the way Windows updates work? Amount of hardware is same as in any laptop. Is Android missing some driver framework or what?
- icebraining 11y agoYeah, Linux in general doesn't have a driver "framework", it has kernel modules, and the in-kernel API is not stable, by design - the position is that keeping a stable API is extra complexity if you want to continue improving the kernel. If you're a driver developer, there are essentially three options: (1) submit the driver to the kernel tree, in which case (if it gets accepted) the developer making the API change will update your module, (2) keep pulling the kernel tree locally and update the module yourself and (3) simply stick with a kernel version. Here's the official explanation: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/stable_api_nonsense.txt http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.g...
- 11y ago
- snowy 11y agoI have a galaxy S6 running android 5.1.1 with device encryption. The lock screen only accepts a password of 16 digits long. So.... Only some devices effected? EDIT: On further research its fixed on 5.1.1. Kind of a stupid fix? Just limiting the size on the input password field? Also I notice that you can no longer copy paste from the emergency call screen.
- mpnordland 11y agoI tried this on my HTC One and I found that I couldn't copy anything from the emergency call screen either.
- jefffoster 11y agoReminds me a little of JWZ's "on toolkits" (https://www.jwz.org/xscreensaver/toolkits.html https://www.jwz.org/xscreensaver/toolkits.html). Writing lock screens is hard!
- PythonicAlpha 11y agoI can't understand in the first place, why copy & paste is active on a password screen that should lock the whole device at all! Of course, deactivating copy&paste would not be a valid solution for this, but the paste feature also could potentially leak user data to unauthorized persons. The copy feature could by accident reveal the password at places where they do not belong.
- Dylan16807 11y agoThe copy is occurring on the phone number input, not the password screen.
- PythonicAlpha 11y agoI understood that. When they activate paste, I guess copy is active to ... (but I don't own such a phone)
- Dylan16807 11y agoIt's very common for password fields to accept paste but not copy. I don't see why you would assume that.
- PythonicAlpha 11y agoOk, I don't see, why they should accept paste at all!
- Dylan16807 11y agoHave you ever used a password manager? As a general rule they should definitely accept paste.
- PythonicAlpha 11y agoA password manager for a locked device? Does that make any sense? I do not have an Android phone or a password manager, but I still do not get the point here. The device is locked, so how do I access the password manager?
- ngcazz 11y agoOnly thing that comes in my mind... http://i.imgur.com/rG0p0b2.gif http://i.imgur.com/rG0p0b2.gif
- fao_ 11y agoI saw this a couple of days ago, I'm still astonished that it works.
- throwaway2048 11y agoyou do realize this is a win 9x era screenshot?
- fao_ 11y agoIt is a moving gif, and regardless of the era that shouldn't have been a valid entry point into windows in the first place. Hence why I am amazed that it works.
- UnoriginalGuy 11y agoWindows 9x was never secure, and I believe that screenshot was taken from Windows 98 or 98SE (hard to tell which). Arguably this is a bug in HP's printer driver. But the fact Microsoft exposed printing to begin with was misguided. I will say, even then, Microsoft intended for businesses and schools to utilise Windows NT 4.0 for this type of scenario. Unfortunately for them 9x become too popular for its own good, so people were buying machines with it and then having it log into AD (which was never really secure scenario, NT is designed for this, 9x wasn't).
- petemc_ 11y agoYou could do similar in SBS2003.
- junto 11y agoThere was a small and relatively unsuccessful F1 racing team around about 10 years ago, who's name I shall not say here. Internally such teams were known as "pit dodgers". When it came to the design of their gearbox, the work was outsourced (as much of it is in F1 unless you are Ferrari). The primary gearbox designer did most of the work, however reverse gear proved to be a problem, but rather than fix the problem, it was left to the junior designer who couldn't solve it either, who also left it pretty much unfunctional. This was based on the concept that: a) Reverse is rarely (if ever needed) (sidenote: disqualified if used in the pits during a race) b) The "pit dodger" team was unlikely to last the entire race anyway, so the gearbox didn't need to standup to a full race duration anyway. The effort put in to designing the components (i.e. precision) can be reduced to match the expectation of success and failure rate of other third party components. Design and production time can be saved and extra profit made. Thus lies the lesson of the emergency call feature, or any other feature that designers feel don't really require that much attention because they are rarely used. These features are often handed to junior developers and engineers, because of the fact that people have a tendency to deem lesser-used features as unimportant. Which is fine of course until you have an emergency and you desparately need to make that emergency call because your, or someone else's life, depends on it. Or you need to reverse out of the way of a damn F1 car coming towards you at 150mph down a straight and you are sitting in the middle of the track. WTF, reverse doesn't engage....oh shiiiiiiit.... TLDR: Features that are very infrequently used are not always the features of least importance.
- otis_inf 11y agoA Formula 1 car is disqualified if its reverse doesn't work (and this is the case for quite some time now). Not sure which team you're referring to, I mean Minardi was sold to Red Bull in 2005, so it has to be before that ;)
- junto 11y agoYou are right. It has to have reverse and that can be checked at scrutineering, but it just has to eventually reverse. It doesn't say anything about having to do it quickly, or effectively: All cars must be able to be driven in reverse by the driver at any time during the Event. BTW, for anyone interested, the current technical FIA F1 2015 technical specifications are here: http://www.fia.com/sites/default/files/regulation/file/2015%20TECHNICAL%20REGULATIONS%202014-12-03.pdf http://www.fia.com/sites/default/files/regulation/file/2015%...
- userbinator 11y agoI know you can just put a limit on it, but a string much less than 1MB in length entered into an edit field can crash a device with probably 1GB or more RAM? If there's a fixed-length buffer somewhere that's being overflowed, it's absurdly large for a password; and if there isn't and it's actually dynamically allocated, that's still pretty sad. I just can't help but ask "what were the people who designed and wrote this code thinking?" This bug just happens to have been brought up in a security context, but if other text edit fields elsewhere in the OS and apps will cause crashes too when fed long strings, that's not just a security issue.
- sumitwgi 11y agoIf you are looking for Website Promotion then choose Best Online Promotion Company Globally visit at http://www.webgatewayindia.com/ http://www.webgatewayindia.com/
- jkrippy 11y agoI wonder if my kids found something similar to this on their Kindle Fire Kid edition. I have parental controls enabled but sometimes the tablet is still running after the predefined cut off time. I remember seeing one time that the PIN entry was popped up with a really long string of numbers in it. They are very very young and wouldn't be able to Google something like this so it was trial and error if they found it.
- userbinator 11y agoThat's a good thing. It means your kids are natural hackers. :-)
- jkrippy 11y agoI'm totally OK with this too! :D
- leoedin 11y agoDid you read the article? They'd need to type somewhere in the region of 160,000 characters to get past the lock screen. If you're not intending to do so (via copying and pasting repeatedly), it seems unlikely you'd manage.
- dsmithatx 11y agoI tried this on my phone last week when I read the article. One I can't cut/paste on my Note 4 Lollipop (At the emergency password screen). Two if you even try to cut/paste or take longer than a second to the phone locks and you have to start over on the password. Maybe it's because I use the finger print reader and password is for emergency. On my phone this hack seems virtually impossible after 10 minutes of trying really hard to get it to work.
- deleted 11y ago[deleted]
- ccvannorman 11y agofacepalm The year is 2015. The basic security of basic devices remains more fucked than ever.
- hawleyal 11y agoIf you have physical access to the device, aren't all bets off anyways?
- lotyrin 11y agoNot theoretically, at least. Even attackers that can read your RAM perfectly can be thwarted by encrypting things and unloading the keys from memory.
- ultramancool 11y agoThose attackers could instead install a hardware based touch screen logger or write a similar attack in software and write it directly to your phone's flash. It's more complicated, but it's still true, once someone has physical access, all bets are off.
- lotyrin 11y agoYes, a device which has been accessed physically shouldn't be trusted anymore (theoretically) but I was talking about the case of a booted device being stolen by an attacker, not the case of one having been returned. In practice, If you can detect intrusion and the device has a secure boot system, wipe the device and issue it new keys, re-encrypt all data to the new keys with some backup cold-stored keys.
- theGimp 11y agoDisk encryption is supposed to be the security measure that thwarts that, to an extent. The attacker can probably use your device, but if you have it set up correctly, they shouldn't be able to read your data.