November 11, 2022
A security researcher, David Schütz has received a $70,000 bug bounty after inadvertently discovering a Google Pixel lock-screen bypass hack that solved a high-severity security problem on all Pixel smartphones that could easily be exploited to unlock the devices.
Schütz discovered the vulnerability, which allowed an attacker to unlock any Google Pixel phone without knowing the passcode. Google fixed the problem, known as CVE-2022-20465, with an update in November, allowing Schütz to publish his findings.
Schütz discovered the problem by chance when he forgot the PIN code of his Pixel phone and had to enter the PUK code to gain access. He noticed anomalies in the lock screen that were presented to him after the successful completion of the process. After accepting his finger, the device crashed with a weird “Pixel is starting…” message, which Schütz addressed with a forced reboot.
The problem per Schütz, is rooted in the fact that lock screen protection is completely defeated when following a certain sequence of steps.
First, provide an incorrect fingerprint three times to disable biometric authentication on the locked device. Then, replace the SIM card of the device with a SIM controlled by the attacker that has a PIN code set up. Then, enter a false SIM pin three times to lock the SIM card. Then, the device asks the user to enter the SIM Personal Unlocking Key (PUK) code, a unique eight-digit number to unlock the SIM card. Then, enter a new PIN code for the SIM controlled by the attacker and the device will be automatically unlocked.
After following this sequence, before entering the PUK code and selecting a new PIN, he realized that he had completely bypassed the lock screen on the fully patched Pixel 6 and Pixel 5.
The sources for this piece include an article in TheHackerNews.
