Hello, World!
A vulnerability in Android which was discovered accidentally allows attackers to bypass the
lockscreen, and was CSI right?
Is it possible to enhance the reflections in someone’s glasses?
That’s all coming up in today’s roundup of cyber security tech news.
There’s a serious vulnerability in Android, which allows anyone to bypass a Google Pixel’s
lockscreen - and it was discovered, by mistake.
Google, has been so slow in patching the bug that the researcher who discovered it had
to threaten to publicly expose the problem just so Google would take it seriously.
The story begins with my friend David, who actually appeared on this channel a
few years ago when I visited a hacker conference in Germany.
He discovered the bug on his Google Pixel 6, when it, ran out of battery.
After plugging it in to charge, it booted back up and asked him for his sim card’s
pin.
Now there’s a good chance your phone has never asked you for this, it’s an extra
setting that you can enable to protect the sim card itself.
But David couldn’t remember what the pin code was, so after 3 failed attempts he managed
to lock himself out of him sim card.
Now, if this happens you need a PUK code - it’s like a master password which can override
a locked sim, it usually comes on a bit of the sim card’s packaging.
But after keying it in, his phone got stuck on a loading screen.
Which is strange, so he tried to reproduce the bug by following the same steps again
- but this time he forgot to do the one thing that caused the problem in the first place,
rebooting the phone.
But missing this step led to even stranger behaviour, this time after entering his sim’s
PUK code his phone just unlocked - without any fingerprint, or password, the lock screen
was completely bypassed.
Let’s back up a bit, if a bad actor comes across a locked pixel phone - or any Android
phone for that matter as we don’t know yet which other manufacturers are vulnerable here,
what’s the process to bypass its encryption and get into it?
First they’d have to disable biometric authentication by just using the wrong fingerprint a few
times, then they’d replace the sim card with their own sim card which is protected
by a pin code.
At this point the phone will automatically ask for the sim’s pin, which they’ll enter
incorrectly until the sim is locked, then they’ll key in the PUK code to unlock the
sim, and finally set a new pin code for the sim.
After this last step the phone glitches and the attacker has full access to the device.
It’s a really simple hack that requires no special equipment.
These kinds of exploits are highly sought after.
I mean, just a few years ago the FBI had a very public fight with Apple over their unwillingness
to unlock a terrorist’s phone.
Lock screen bypass exploits are highly useful to the government and bad actors, so it shouldn’t
be any surprise that Google awards up to $100 thousand dollars to people who find and report
bugs like this.
And David, just so happens to be a bug hunter, so he wrote up and submitted a report.
You would expect Google would fix the bug asap, pay David his bounty and well, that
would be the end of it.
Instead David says ”there was basically a month of silence”.
But then he received the email that all bug hunters dread: “The Android Security Team
believes that this is a duplicate of an issue previously reported by another external researcher.”.
Basically someone discovered the bug before him, claimed the pot of gold and well - there
was no more gold to be had.
But this isn’t where the story ends… fast forward a few months and Google released the
September update for the Pixel lineup.
You would assume the bug would have been fixed by now, having been reported months ago, but
“no”, he “was still able to unlock the phone.”.
And coincidentally David just so happened to be attending Google’s bug hunter event
Escal8 at the same time, so he “did a live demo … inside Google’s office”.
But even after that, still, the bug went unpatched.
At this point he was frustrated, to say the least - it had been 4 months since he reported
the vulnerability - and who knows how long since the first disclosure to Google - the
one that invalidated his claim to the pot of gold.
Google had been given every chance to fix the bug, so David played the one card that
was bound to get their attention.
He gave Google a deadline of October 15th, on which he’d publicly disclose details
of the bug whether it’s patched or not.
This is considered a nuclear option for bug hunters, something they’ll only do as a
last resort when a company for whatever reason fails to patch a vulnerability within a reasonable
time frame.
And - well, it got Google’s attention.
They got in touch with him, wanting to “set up a call” and discuss things.
And finally this is when Google started to listen, promising to fix the bug in November’s
update.
This did surpass the October 15th deadline, but David was understandably a bit apprehensive
about publicly disclosing the bug when it was still unpatched, so he backed out of that.
In fairness, he would’ve received a lot of scrutiny for publicly exposing the bug
so close to when Google said they would fix it, so you’re free to disagree but he probably
made the right decision.
Google sent him one final email which explains a few things, they said they didn’t take
any action after the bug was first reported because they were “not able to reproduce
the vulnerability”, that could be because the report was just written badly or maybe
a Google engineer just didn’t do it right.
But this changed after David’s report.
They go on to say they “typically do not reward duplicate reports; however, because
your report resulted in us taking action to fix this issue, we are happy to reward you
the full amount of $70,000”.
In making this video I spoke to David, and he wanted to make it clear that “even though
this was mainly pixel specific”, “there are other vendors, that are vulnerable”,
because “the patch was in Android itself”.
So give it a go on your own device and let me know down below if your phone is vulnerable.
Also, I make sure to link David’s channel and his full write up below, it’s well worth
a read.
We all thought CSI was just making a meme out of themselves, when using ‘technology’
they managed to catch bad guys by ‘enhancing’ a reflection in someone’s glasses.
“The reflection, that’s [unintelligible] baseball team, that’s their logo/ And he’s
talking to whoever’s wearing that jacket.
We may have a witness” But, was CSI just ahead of the their time?
And is this now possible.
I mean - just last year a drug dealer was jailed for 13 years after police ID’d him
using his fingerprints from a photo of a block of cheese.
So is deciphering reflections in glasses really that far fetched?
Well, researchers have investigated in a new paper titled “Private Eye”, and they’ve
made some surprising discoveries.
So, rather than justifying this research with the meme itself, they say it’s an important
topic because “video conferencing has become a new norm”, thanks to working from home
becoming more common.
And, well - that’s the context here, is it possible to enhance the reflection in someone’s
glasses from their webcam feed during a zoom meeting, to the point where you can read the
text on their computer screen?
Well, given it would probably depend on the resolution of the victim’s webcam, the researchers
tested against a 720p builtin laptop webcam, a 1080p logitech webcam, and a 4k camera.
And to achieve a CSI style ‘enhance’ they used a technique called “multi-frame super
resolution”, this is the kind of tech that’s used in mobile phones to improve the resolution
of photos when zooming in.
It relies on taking a short burst of images, which provides subtle variation between frames.
And then, by using a reference frame you can overlay the photos… which gives you a strange
morphing gif looking kind of a thing.
But an algorithm can take this and use it to infer what might pixels might lie between
the pixels it has, thus constructing a higher resolution image.
However in this case, other factors like the viewing angle of glasses had to be taken into
account.
The researchers found that by using a laptop’s builtin 720p camera it was “possible to
reconstruct and recognise with over 75% accuracy on-screen texts that have heights as small
as 10 mm”.
But, 10mm or 1cm, is rather large text, it’s not quite on the level of CSI.
But, this does change a bit when using a 4k camera - I realise, it’s not a webcam, but
the researchers included it, to give us an idea of how future webcams might perform - in
which case “4k cameras will tip the threshold of text leakage to reconstruction of most
header texts on popular websites”.
But still, it doesn’t really seem that significant - but what is more interesting is their section
on ‘website recognition’, as in figuring out what website someone is on via the reflection
in their glasses…
think your boss wanting to check whether you’re actually following along with the quarterly
report or if you’re just browsing reddit or something.
In that case, using only a 720p webcam and testing against a list of the top 100 websites,
they were able to achieve a “maximum recognition accuracy of 94%”, and this is “without
using [fancy] machine-learning models”.
Realistically though, I don’t think we have much to worry about, but how can the paranoid
among us combat this emerging threat?
The researchers have one idea, they wrote “For software mitigations, we notice Zoom
provides virtual filters of non-transparent cartoon glasses”, I believe they’re referring
to, these.
Having working code only to find out that the version it runs on is going end-of-life
is frustrating, you would have to quickly migrate to the latest version, with a bunch
of code refactoring and rewriting.
But not with TuxCare, they help you plan the transition with their Extended Lifecycle Support,
which covers a range of linux distros, as well as PHP and Python.
With TuxCare you can keep your existing codebase and still receive security updates and patches
for deprecated versions.
This means that if your codebase still meets your operational requirements, it can still
meet your security targets, giving you time to plan your next move.
Learn more about TuxCare’s Extended Lifecycle support by clicking on the link in the video
description.
As always thanks for watching and I’ll see you in the next video, have a good one.