Expert: Lock Screen Phone Will Never Be Watertight

This week it was announced that a leak in Android 5.x makes it possible to bypass the lock screen, but as a developer of the Plasma Phone this kind of problem will always be present and screen lock can not provide watertight protection against a physical attacker.

The Android vulnerability has been patched by Google, but the update has not yet appeared for all the different models and manufacturers. Unlike a screen lock on the desktop may apply for a different phone lines. So the phone should still be able to accept incoming calls, even if the screen is locked. In addition, there must be interaction with notifications, for example, an alarm clock, are possible. Also, it should be possible to make emergency calls on a locked phone.

"These exceptions conflict with the requirements of our lock on the desktop. That is, blocking input devices, so an attacker can not communicate with the active session," said developer Martin Grasslin. The requirements set that it must still be possible at a locked phone to communicate with a running session and also be input devices, such as the keyboard, not blocked.

Grasslin has in recent months been thinking a lot about how these requirements can be combined without compromising on safety and has not found a solution yet. "The only thing I see is that if we applications such as the phone app, let's bypass the lock screen, we actually add a hole on the architecture and if there is a hole to penetrate you thereby. There will always be a way to bypass security, "he noted.

Target lock screen

According Grasslin must be also looked at the intention of the lock screen. On the desktop computer is simple, namely that getting someone with a mouse or keyboard can not access the active, locked session. For a phone this is different, especially if an attacker has physical access. "If someone has enough time, it is unlikely that the attacker can be kept outside and the screen lock is probably not the weakest link in the chain."

It is therefore not possible to blocking input devices, but that people can not see the contents of the phone during an unguarded moment. In this case the now unveiled Android leak not really matter, as it takes some time to execute. "The screen lock prevents access by ignorant people and also by people who only have the same access to it. It's only a problem in situations where it would not matter much, because if you have the device already physically in your possession," said Grasslin.

Android Vulnerability Allows Attacker Bypass The Screen Lock

Researchers at the University of Texas have discovered a vulnerability in Android 5.x could allow an attacker with physical access to bypass the lock screen of the device, even if the encryption is enabled. By first turn on the camera app and then typing a large number of characters in the password field allows an attacker to crash the lock screen, so that the home screen is displayed.

It is then possible to start any application or access can be enabled via ADB, in order to gain full access to the device. To carry out the attack, an attacker must have physical access and the user must have enabled a password. In the case of a PIN code or lock pattern, the attack would not work. Google was on June 25 informed by the researchers. On September 9 released Android 5.1.1 build LMY48M where the problem is corrected.

This update was last week among Nexus devices from Google itself rolled, but it is unknown when users of other Android devices will receive the update. Google develops updates for Android and can roll under its own Nexus devices. In other cases, users are dependent on their manufacturer or network provider before they get the update. A process that can sometimes take weeks or months.