This is a flaw with Lollipop, the latest version of Android.
From the locked screen, open the phone’s “Emergency Call” feature. Type a few characters, then copy-and-paste the text repeatedly. The character “string” grows exponentially, so it quickly becomes close to 40,960 characters long.
Then open the phone’s camera app and prompt the phone to request a password. Paste the super long character string a few times until the system crashes. (Based on Gordon’s video, it looks like 163,840 total characters.)
Wait maybe five minutes, and the phone goes straight to the unlocked home screen.
And:
Google has acknowledged the flaw, saying that the hack lets someone who grabs your phone “view contact data, phone logs, SMS messages, and other data that is normally protected.”
Most importantly:
The patch is already available for Google’s own line of phones — the various Nexus models. But there’s no telling when it’ll reach Android devices made by Samsung, LG and others. Blame the Android’s fractured updating system, which is slowed down by phone manufacturers and cellphone network carriers.
That last is the fly in the ointment.
If this happened to the iPhone, it would be the top story on every news site.
At one level this is a hack, no doubt. But the number of people who have the know how to do this I imagine is ridiculously small.
And if we remember the Touch ID “hack” was also a hack. That is, if you had a ridiculously expensive printer, a perfect copy of a fingerprint and a few other things that again, most people wouldn’t have access to.
If you could hack a phone via a few simple swipes or a simple three digit code then there’d be cause for concern.
Vulnerabilities exist in all devices. But “Lollipop” type naming conventions, and the new pre-school look of alphabet blocks branding, I wonder as to the attention span at Google these days.
Are you kidding!? this is the easiest hack I’ve ever seen and one that anyone looking to steal and hack an android phone would know about. Amazing you are defending Google on this.
Yup. Doesn’t even rely on ridiculous timing like previous (and probably future) lock screen unlocks on iOS.
But the number of people who have the know how to do this I imagine is ridiculously small
Well, everyone that read this report or any of the others.
So, large and growing exponentially?
Really, just don’t expect any serious level of privacy or security from an Android device. Ever.
Replicating physical features which imitate the real thing well enough to trick dumb technology is one thing, a stupid (what I assume is a) buffer overflow bug is something entirely different. There’s no perfect way to defend against imitated finger prints, but buffer overflow bugs have been a solved problem since forever.