Discovery of vulnerability in Pixel smartphones earns 'bug bounty hunter' $70,000
The discovery of a vulnerability in Google Pixel smartphones earned Hungarian David Schütz $70,000. It found a way to bypass the lock screen of Android devices.
Although David is commercially a "bug bounty hunter", he discovered this vulnerability by accident after forgetting his SIM card's PIN. After entering the PUK code, he noticed that his phone was unlocked without asking for a preset PIN/password.
Further investigation showed that only biometric security still works after entering the PUK code and that if 'disabled' beforehand (using false fingerprints several times), the phone will be unlocked immediately after entering that PUK code.
Thus, a malicious person can unlock your phone by changing the SIM card, entering some wrong codes and then entering the correct PUK code.
David reported the issue to Google, and after months of waiting, uncertainty about a possible bounty, and even some threats about David revealing the vulnerability, the workaround was finally patched in Android's security update (CVE-2022-20465). moon.
The fact that the patch is included in the general Android update and therefore not released separately for Pixel devices alone may mean that the vulnerability is also present on other Android devices that have not yet been updated. In any case, David is rewarded with $70,000 for his efforts.
Source: David Schutz's Blog
Source: Hardware Info
Comments
Post a Comment