Android Security Flaw Allows You To Bypass Lock Screen Using A Large Password

Android Lock Screen

A recently discovered Android security flaw allows users to bypass the lock screen on most version of Android Lollipop. This vulnerability exists in Android 5.x and allows an attacker to crash the lock screen and gain full access to a locked device, even if encryption is enabled on the device.

The technique bypasses the lock screen by crashing it with any large enough password. All you need to do is work with that text while the camera app is open, and then enter it into the password prompt.

The exploit does not work if either you are using a PIN code or a pattern unlock. Google has fixed this issue in the “LMY48M” Android 5.1.1 build released last week for the Nexus 4, 5, 6, 7, 9, and 10.

The flaw can be exploited by adding a large number of characters to the emergency call window and then copying them to the Android clipboard. The hacker then swipes open the camera from the locked phone, accesses the options menu, and pastes the characters into the resulting password prompt. Instead of returning an error message, vulnerable handsets unlock.

Here is a video demonstrating how to exploit the security flaw.

This threat is not serious considering the hacker need to have physical access to your smartphone, but it is not far off. While Android device makers are getting better about timely security fixes, you may be stuck with a hardware that gets its patch either late or not at all.

Vulnerable users who cannot get an update or do not want to wait for one to become available can switch to a PIN or pattern-based lock screen. Unfortunately, a research paper indicates both PIN and Pattern Lock method are very predictable. So affected users are forced to choose between a flawed unlock method or a predictable unlock method. While this is not the end of the world by any stretch, it is not exactly comforting.

Fortunately, only smartphones running Android 5 was affected making the number of affected handsets is only a small fraction of the overall Android user base.

Source: University of Texas

Amarnath Natarajan Avatar

Help Us Grow

If you like this post, please share it with your friends.

You are free to copy and redistribute this article in any medium or format, as long as you keep the links in the article or provide a link back to this page.

Subscribe to Newsletter




Privacy Settings

Privacy & Cookie Overview

Our website uses cookies to provide you with the best user experience possible. These cookies are stored in your browser and perform essential functions such as recognizing you when you return to our website, as well as helping us to understand which sections of the website you find most useful and engaging.

To learn more, you can read our Privacy & Cookie Policy or reach out through our Contact form.

Strictly Necessary Cookies

Strictly Necessary Cookies must always be enabled to ensure the proper functioning of this website and to allow us to provide you with excellent service. These cookies are also essential for saving your cookie preferences.

Google Adsense

We use Google AdSense to keep this site free by displaying relevant ads. AdSense requires essential cookies that cannot be disabled, but you can manage other cookies. We respect your privacy and provide options to control non-essential cookies.

For more details on how Google handles your data, visit Google's Data Usage Policy. Please review our Privacy Policy for more information on how we protect your data.

AddToAny

We use AddToAny for social sharing. It doesnโ€™t store cookies, ensuring a privacy-friendly experience. AddToAny complies with GDPR and CCPA by default.

For more, see their Privacy Policy.

OneSignal

We use OneSignal to send notifications to users who opt in. OneSignal complies with GDPR and is certified under the EU-US and Swiss-US Privacy Shield frameworks.

For more, see their Privacy Policy.

3rd Party Cookies

This website utilizes third-party cookies, which can enhance your experience and support our ongoing efforts to improve our services.

Google Analytics

We use Google Analytics to collect anonymous data, such as visitor numbers and popular pages, to improve user experience and site performance. Keeping this cookie enabled helps us refine the site based on visitor activity.

For more information, see Googleโ€™s Privacy Policy.

Discover more from Prime Inspiration

Subscribe now to keep reading and get access to the full archive.

Continue reading