Android phones can be unlocked without a password, study says

A cybersecurity researcher has accidentally discovered a method to get around the lock screen of Android phones. According to the report, the abuse of the lock screen flaw only takes five simple steps that an individual could execute within a couple of minutes.

The researcher revealed that he found the vulnerability by accident after his Android phone (Pixel 6) ran out of power, entered his PIN incorrectly three times, and retrieved the locked SIM card using the Personal Unblocking Key (PIN) code.

However, the Android device did not request the lock screen password and only asked for a fingerprint verification scan after unlocking the SIM and choosing a new PIN. The incident raised concerns since Android devices should request a security pattern or password upon reboot for security purposes; hence, going directly to fingerprint scan to unlock was uncommon.

 

A user could also exploit the flaw in the Android phones without draining the battery power.

 

The flaw discoverer continued to tinker with the Android phone flaw and tried to reenact the incident without rebooting his device. They concluded that an individual could still exploit the flaw to bypass the fingerprint prompt that leads to the device’s unlocked home screen.

This vulnerability could allow an unwanted individual to use the SIM card on the targeted device, deactivate biometric authentication, enter an incorrect PIN thrice, provide the PUK code, and access a target’s device without restrictions.

Based on investigations, the current issue results from the keyguard being wrongfully dismissed after a SIM PUK unlock. A conflict in the dismiss calls affected the stack of security screens that operates under the dialogue.

The dismissal of the PUK security screen has also dismissed the next security screen, which is the password-protected keyguard, followed by anything screen that was next in the stack. Hence, if a user dismisses all security screens, the phone will go to its unlocked home screen.

The researcher who discovered the bypass reported it on Google last June. However, the big-time tech company only released a patch for the vulnerability earlier this month.