Samsung Galaxy Note II Lock Screen bypass vulnerability

Posted: March 4, 2013 in Analysis, Vulnerabilities
Tags: ,

iOS was in the news lately for a series of security mishaps, but this time android back in scene. A security flaw discovered by Terence Eden on the Galaxy Note II with Android 4.1.2 that allows hackers to briefly bypass the phone’s lock screen without needing a password. By hitting “emergency call” then “emergency contacts” then holding the home button, the main home screen becomes visible for around a second just enough time to load an app, before reverting back to the lock screen.

The flaw appears to be similar to a screen lock vulnerability in newer Apple devices, including the iPhone 5

Steps to follow:

  1. Lock the device with a “secure” pattern, PIN, or password.
  2. Activate the screen.
  3. Press “Emergency Call”.
  4. Press the “ICE” button on the bottom left.
  5. Hold down the physical home key for a few seconds and then release.
  6. The phone’s home screen will be displayed – briefly.
  7. While the home screen is displayed, click on an app or a widget.
  8. The app or widget will launch.
  9. If the widget is “direct dial” the phone will start ringing.

Using this method it could also be possible to load up email or SMS apps for long enough to get an overview of sensitive messages.

 

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s