This Google Pixel bug fix could have caused

A vulnerability that affects "seemingly all" Google Pixel phones could have allowed unwanted parties to gain access to a locked Pixel device.

According to a blog post (opens in a new tab) by cybersecurity researcher David Schütz, whose bug report convinced Google to take action, the bug was only fixed for the Android phones in question after a security update. dated November 5, 2022, approximately six months after filing. the bug report from him.

The vulnerability, identified as CVE-2022-20465 (opens in a new tab), allowed an attacker with physical access to bypass lock screen protections such as fingerprint and PIN and gain full access to the user's device. Username.

How did the exploit work?

Schütz, who claimed that a previous bug report from another researcher pointing out the problem was ignored, said the exploit was simple and easily reproducible.

This involved blocking a SIM card by entering the wrong PIN code three times, reinserting the SIM tray, resetting the PIN code by entering the SIM card's PUK code (which should come with the original package), and then choosing a new PIN code.

Since the attacker could simply bring their own PIN-locked SIM card, only physical access was needed to run the exploit, according to Schütz.

Potential attackers could simply swap such a SIM card in the victim's device and run the exploit with a SIM card that has a PIN lock and for which the attacker knows the correct PUK code.

To Google's credit, despite the severity of the exploit, Schütz claims that after submitting a report detailing the vulnerability, Google dealt with the exploit in 37 minutes.

Although Schultz offered no proof, he posited that other Android vendors might have been affected. It certainly is possible, because Android is an open source operating system.

It's also not the first time a security researcher has discovered serious security flaws in Android phones.

In April 2022, Check Point Research (opens in a new tab) (CPR) discovered a flaw that, if left unfixed, could leave a large number of Android phones vulnerable to remote code execution, due to vulnerabilities in Qualcomm audio decoders. and MediaTek chips.

Share This