Android Smartphone Lock Screen Bypass Security Flaw Discovered: How To Stay Safe?

Android smartphones have multiple levels of security, but they could be circumvented in certain situations. A security researcher discovered how to bypass the lock screen on an updated Google Pixel smartphone. Although Google quickly acknowledged and issued a patch, it is likely that thousands of Android smartphones from other manufacturers may remain vulnerable.

All Security Levels Of Android "Accidentally" Bypassed

Cybersecurity researcher David Schütz found and recorded a way to bypass the lock screen of an Android smartphone. He managed to confirm his findings on "fully patched Google Pixel 6 and Pixel 5 smartphones". Physical possession of the target device is necessary, but the process is short.

David claims exploiting the vulnerability to bypass the lock screen on Android phones doesn't take more than five simple steps. He discovered the vulnerability after his Pixel 6's battery was completely drained and he entered his PIN wrong three times. Upon entering incorrect authentication details, an Android device may lock the SIM card as well, requiring PUK (Personal Unblocking Key) code.

David discovered that after unlocking the SIM card and selecting a new PIN, his device went straight to fingerprint scan. An Android smartphone, upon reboot, should first ask for the lock screen password. Strangely, the vulnerability can be exploited if the device isn't rebooted, as in this case, even the fingerprint scan is bypassed.

Security Bypass Flaw Affects Android 10, 11, 12, And 13

It appears the flaw exists in the way Android devices invoke a "dismiss" function after examining the SIM state and PUK status. The security flaw could allow people access to data on devices they don't own. Google has acknowledged the flaw and even rewarded the security researcher for responsibly alerting the company.

Google has issued a patch to address this vulnerability. Moving forward, a new parameter for the security method is used in every "dismiss" call. Simply put, the installed Android OS will insert a security check after every action.

The November 7, 2022, security update contains the patch meant to address the security vulnerability. It is available for Android 10, 11, 12, and 13. Hence, it is important to keep devices updated. Although Google has issued a patch, several Android smartphone manufacturers aren't sending regular updates to their older devices. Such Android mobile phones could remain vulnerable to this security flaw.