Database Info

Serious Android Lock Screen Vulnerability

Not sure if this is well known or not but if you lose your android phone and think that your 4 digit lock screen password is going to cut it, you may be wrong. I realize that most people here know multiple ways to get access to a device but I haven't seen this way before and thought it was unique.
A 4 digit password can be brute force hacked in 16.5 hours, using the USB rubber duckie developed by the guys at Hak5.
They have a detailed video posted over at: http://hak5.org/episodes/hak5-1217
It works because android doesn't implement longer wait times between unsuccessful pin entries. Every 5 tried it locks you out for 30 seconds. That's it! That's all! Every 5 times, 30 seconds over and over again! It never gets longer! Thus why it takes 16.5 hours to go from 0000 to 9999 with one second between attempts, and 30 seconds between every 5 attempts.
Hopefully this gets fixed in the next version of android. For comparison, BlackBerry has a 10 password rule and the phone gets wiped and Apple makes successive longer wait times and will ultimately lock itself and need to be plugged into the original syncing computer (I believe, not really a big Apple fan, so I don't know for sure)

Thanks for this information
The difference in the time it takes to break a 5 digit pin or a 10 digit pin is cRaZy

Sure, the wait times should be "smarter" - but if you're keeping TRULY sensitive information on your phone, just use a real password to unlock it, not a PIN.
Or, perhaps a solution in the spirit of Android would be to let people decide for themselves how they want it implemented. Some people wouldn't care and wouldn't want their data to be wiped after ten wrong tries - I mean, wow - that would suck if someone knew that and wanted to be malicious and wipe your phone for the lulz or whatever. Or if you wanted to let a kid play with it - which I've read a lot of people do (beats me, but hey). Other people who need tighter security could choose that.

Any tips on how to bypass or brute force the android pattern lock?

After a certain number of tries, Android will not allow you to unlock via PIN, and force you to enter a Google account registered on the phone.
Hacker can't get past that unless they know whose Google account is on the phone, and then they have to hack a Google account
Sent from my DROID2 using xda premium

I have never thought the android lock screen was any good if im honest. if you have a dirtyish screen you can actually see the pattern you draw.
Sent from my Nexus 7 using xda app-developers app

What gagdude said, after so many failed attempts you need to login via your associated Google account.

Ty for sharing
Sent from my MK16i using xda app-developers app

Hmmmm interesting, wonder how long it would take for the pattern method of unlocking.

xillusionzx said:
Hmmmm interesting, wonder how long it would take for the pattern method of unlocking.
Click to expand...
Click to collapse
Depends. A 4 digit PIN is 10*10*10*10=10000
A pattern can be from 9*8*7*6 to 9! possibilities
Sent from my Nexus 4

Hi!
I just think PIN is unuseful. I was cheated by one of my friend because he discovered the PIN of my phone. I give my phone to nobody no more. Now I have a phone without protection: it is more comfortable!

Put any password /pin, u can just boot into recovery, do a factory reset and it's all gone! Right? (in case of theft I'm talking about)

Thanks for the heads up, my mother in lay asked this about her new Note II today.

Lifehacker7 said:
Put any password /pin, u can just boot into recovery, do a factory reset and it's all gone! Right? (in case of theft I'm talking about)
Click to expand...
Click to collapse
As if someone who actually goes low enough to steal know what recovery is.
What I'm trying to say here us that the average person doesn't know what recovery is.
Sent from my Nexus 4

gagdude said:
As if someone who actually goes low enough to steal know what recovery is.
What I'm trying to say here us that the average person doesn't know what recovery is.
Sent from my Nexus 4
Click to expand...
Click to collapse
Just sayin!

Lifehacker7 said:
Just sayin!
Click to expand...
Click to collapse
I know; I used to worry about this until I asked my friend about it and he was like "what's recovery? Stop being a nerd." And then it hit me: people don't know what it even is, much less how to boot into it
Sent from my Nexus 4

Yeah, but all but the dumbest theives have the wits to Google search If they have an issue that's in the way of turning a profit (like a lock screen). It's occupational information even if it's not known to "normal" people. You know, like lock picking, hot wiring, et cetera. Not all theives are rock-stupid - and maybe some are, and but they're stealing phones they can't sell at low costs/for meth to someone who in fact does know how to make these devices much more profitable.
Sent from my Transformer TF101 using xda app-developers app

If someone steals my phone he can just flash a new rom on it.
No need to brute force the password/pin unless he's after my personal info/my messages.

BAD LUCK! Just posted to get empathy

Yesterday I flashed CM 13.1 on my OPO and postponed the final tune ups and settings to later and went out to the gym and LOST it there (Or possibly has beed stolen!) and It's so painful because I hadn't installed and activated Adnroid Device Manager and teh Lockscreen was open //I feel very upset now…
I know that nothing can be done and this topic is not relevent here and can be removed, it's OK

roshak said:
Yesterday I flashed CM 13.1 on my OPO and postponed the final tune ups and settings to later and went out to the gym and LOST it there (Or possibly has beed stolen!) and It's so painful because I hadn't installed and activated Adnroid Device Manager and teh Lockscreen was open //I feel very upset now…
I know that nothing can be done and this topic is not relevent here and can be removed, it's OK
Click to expand...
Click to collapse
Just saying, is it too hard for them to go to recovery and flash any other rom? They can erase your current rom as well no matter what security app you use, right? So, the sooner this thread gets deleted......

Theoretically Cerberus pro can resist a Factory Reset, but I don't know how it does that and if it's bypassable...

sad bro! whats your next phone?
Sent from my A0001 using Tapatalk

Maybe you can try something like AndroidLost? Though, I believe it requires Google account to be on device beforehand. I'm not sure if it's compatible with CM13, but nothing wrong with trying at this point
Edit: Yep, you do need Google account on device for this app to work. Check this out.

bachera said:
sad bro! whats your next phone?
Sent from my A0001 using Tapatalk
Click to expand...
Click to collapse
OPX I guess... but not sure yet. Don't like the OP2

xymic said:
Maybe you can try something like AndroidLost? Though, I believe it requires Google account to be on device beforehand. I'm not sure if it's compatible with CM13, but nothing wrong with trying at this point
Edit: Yep, you do need Google account on device for this app to work. Check this out.
Click to expand...
Click to collapse
very useful tips. But unfortunately the location on my device was been always deactivated (just when i wanted to search am adress manually, and that was 4 days before I lost!!)

well report it stolen that way they block the emei I think. Then you are sure they wont be able to do anything on the phone. In rare cases they find it and can get it back. Very rare cases. Hope your new phone will be just as satisfying
Sent from my A0001 using Tapatalk

bachera said:
well report it stolen that way they block the emei I think. Then you are sure they wont be able to do anything on the phone. In rare cases they find it and can get it back. Very rare cases. Hope your new phone will be just as satisfying
Sent from my A0001 using Tapatalk
Click to expand...
Click to collapse
The IMEI can be changed, wouldn't make a difference if someone is determined once they have the device in their hands
Sent from my A0001 using Tapatalk

Renosh said:
The IMEI can be changed, wouldn't make a difference if someone is determined once they have the device in their hands
Sent from my A0001 using Tapatalk
Click to expand...
Click to collapse
true gladly most dont know about that. Also its a tedious process. Kind of mixed on that cause it can be damn handy, lost my imei on several devices due to a series of unfortunate events. On the other hand it is real handy for the situation of a lost device.
Sent from my A0001 using Tapatalk

Issues
MMMMM My OPO has lost its IMEI so I must change it, any details would be most helpful.

use your cyanogen account. You can use it to locate and wipe if need be and track too!

itechy said:
use your cyanogen account. You can use it to locate and wipe if need be and track too!
Click to expand...
Click to collapse
The unit is not lost.. the IMEI is. It is an invalid one. No matter what I try and have done to the unit it does not come up as a valid one. I was told I would need to change it and then it would be fine. Any help would be great! :good:

Samsung Agent blah[Marshmallow]

DELETE

What exactly did you expect them to tell you?

PDXMatt said:
What exactly did you expect them to tell you?
Click to expand...
Click to collapse
Same as always
Sent from my SM-N920T using Tapatalk

A better question why people are obsessed to have the latest android on the phone? Who cares which ANDROID version is running when most people are using third party software anyway. Every Android upgrade brings more and more restrictions. From my experience, I can't tell much difference between 4.x and 5.x android except the restrictions which prevents some of my apps from working properly, such as tasker, avast anti theft and etc. What do you expect to see in marshmallow and you can't see in Kit Kat with TW. Don't forget that most of the stuff you see in Note 5 is TW apps and are not native android apps except Dialer

Almazick said:
A better question why people are obsessed to have the latest android on the phone? Who cares which ANDROID version is running when most people are using third party software anyway. Every Android upgrade brings more and more restrictions. From my experience, I can't tell much difference between 4.x and 5.x android except the restrictions which prevents some of my apps from working properly, such as tasker, avast anti theft and etc. What do you expect to see in marshmallow and you can't see in Kit Kat with TW. Don't forget that most of the stuff you see in Note 5 is TW apps and are not native android apps except Dialer
Click to expand...
Click to collapse
I've never understood the obsession either. I have an international M9 that has Marshmallow and frankly, it's virtually the same phone as it was with Lollipop. Marshmallow or not, I love my Note5. Marshmallow will come when it comes. I'm not going to lose any sleep over it.

PDXMatt said:
I've never understood the obsession either. I have an international M9 that has Marshmallow and frankly, it's virtually the same phone as it was with Lollipop. Marshmallow or not, I love my Note5. Marshmallow will come when it comes. I'm not going to lose any sleep over it.
Click to expand...
Click to collapse
Almazick said:
A better question why people are obsessed to have the latest android on the phone? Who cares which ANDROID version is running when most people are using third party software anyway. Every Android upgrade brings more and more restrictions. From my experience, I can't tell much difference between 4.x and 5.x android except the restrictions which prevents some of my apps from working properly, such as tasker, avast anti theft and etc. What do you expect to see in marshmallow and you can't see in Kit Kat with TW. Don't forget that most of the stuff you see in Note 5 is TW apps and are not native android apps except Dialer
Click to expand...
Click to collapse
I understand your point thnks
Sent from my SM-N920T using Tapatalk

Just do this. How messed up would it be if we had a locked bootloader?
They suck, but look at att and sprint forums.
It's a war and about $. But, I still love t-mobile.
What phone could we switch to and be happy? Those Google phones suck. What's an iPhone?

10-K said:
Just do this. How messed up would it be if we had a locked bootloader?
They suck, but look at att and sprint forums.
It's a war and about $. But, I still love t-mobile.
What phone could we switch to and be happy? Those Google phones suck. What's an iPhone?
Click to expand...
Click to collapse
I am using teks rom took
Sent from my SM-N920T using Tapatalk

I hope you did not create this thread (dont know why really) just to gain sympathy since it does not shed any extra light or truly help out in any fashion. Sorry guys its not here and I am sure there is a good reason for it. But its not like we need to know. Your device is not rendered useless without Marshmallow so again the point is?
Sorry not trying to bash or berate anyone just think maybe the other half dozen threads asking and receiving the same treatment would be enough for some of you to realize its not that important....
I mean for crying out loud there are more important things like protecting Beyonce from the mean people saying she is a Black Panther.
peace out people

playya said:
I hope you did not create this thread (dont know why really) just to gain sympathy since it does not shed any extra light or truly help out in any fashion. Sorry guys its not here and I am sure there is a good reason for it. But its not like we need to know. Your device is not rendered useless without Marshmallow so again the point is?
Sorry not trying to bash or berate anyone just think maybe the other half dozen threads asking and receiving the same treatment would be enough for some of you to realize its not that important....
I mean for crying out loud there are more important things like protecting Beyonce from the mean people saying she is a Black Panther.
peace out people
Click to expand...
Click to collapse
That last part about Beyonce...PRICELESS!

No wonder xda is like it is
Sent from my SM-N920T using Tapatalk

JonathanRAZ said:
No wonder xda is like it is
Sent from my SM-N920T using Tapatalk
Click to expand...
Click to collapse
And that is?

PDXMatt said:
And that is?
Click to expand...
Click to collapse
My guess is typical millennial kiddie posted a useless thread, gets called out, and rages about the forum or something. Mod delete.

..

encryption question

If i enable encryption under settings, will my device become slower to access everything on it? it will have to decrypt everything once unlocked right?

I just encrypted mine. I have not noticed a performance change. It does take longer to reboot.
Sent from my SM-N920V using Tapatalk

liquidraven said:
If i enable encryption under settings, will my device become slower to access everything on it? it will have to decrypt everything once unlocked right?
Click to expand...
Click to collapse
When I had a Nexus 6, the only time I really noticed a performance dif is when I was adding/removing files to the phone. Read/write times took a pretty big hit...

mademan420 said:
When I had a Nexus 6, the only time I really noticed a performance dif is when I was adding/removing files to the phone. Read/write times took a pretty big hit...
Click to expand...
Click to collapse
ok thanks

Mr. Toad said:
I just encrypted mine. I have not noticed a performance change. It does take longer to reboot.
Sent from my SM-N920V using Tapatalk
Click to expand...
Click to collapse
I encrypted my phone almost as soon as it was done with its initial configuration (my standard practice) so I don't have much of a baseline for doing a before and after comparison. But it doesn't seem to me to have any perceivable performance hit. From many tests I've seen, Samsung devices in general seem to take less of a hit from encryption than other brands. That said, performance hit or not, my advice to anyone with the least bit of sensitive data on your phone: secure it in every way you can including encryption. I know too many people walking around with things like their bank accounts etc on their phones without even a pattern unlock. They are really just asking for it IMO.

There is a good YouTube video that features the Note 5 in a comparison, sorry I don't have a link. But because of the built-in hardware encryption there is no noticeable difference between the 2. He ran some benchmark tests and barely a difference. Went ahead and found the video: https://youtu.be/KSVhRKe6O9c
Sent from my SM-N920V using XDA-Developers mobile app

Possible Solution to Titanium Backup stuck at 0%

If you are having issues with Titanium Backup while you are restoring (if it stays at 0%), then try this.
Possible Solution to T.B:
1) Go to settings > General > About Phone > Software info
2) Press build number 7 times
3) Go to Go to settings > General > Developer options
4) ACTIVATE USB DEBUGGING MODE!
5) That's it. It shouldn't get stuck at 0% anymore
Hope it helps :good:
If this doesn't work, use the method found in Post #11 thanks to @buzzboy for finding it!

Congrats on figuring that one out.

Gonna try this out!
Sent from my LG-H918 using Tapatalk

carandcar said:
Gonna try this out!
Sent from my LG-H918 using Tapatalk
Click to expand...
Click to collapse
Good luck! This worked for me.... sadly by the time i did it, i had already deleted all my data since i thought it was corrupted LOL

No go. ?
Thanks for the suggestion. It has to be something recent because this just started to happen out of the blue.
Sent from my LG-H918 using Tapatalk

carandcar said:
No go.
Thanks for the suggestion. It has to be something recent because this just started to happen out of the blue.
Sent from my LG-H918 using Tapatalk
Click to expand...
Click to collapse
Yeah i know. Did you give it at least about 30 seconds on the box showing 0% and see if it moves? . If it didnt work, then i will change the title to "Possible Solution"

It seems that Google f***d up something.
Enviado desde mi Nexus 6P mediante Tapatalk

Started happening to me yesterday, using Pixel XL. Very frustrating. USB debugging was already on.
Edit:Happening on my Nexus 6p also!
Have emailed the developer, i suggest you do the same.
[email protected]

Same here, not working. I tried also the "Auto Indirect" mode in PREFERENCES / APP PROCESSING MODE of TB Pro. I did a new install of SuperSU. I did a full clean install of the system. Nothing works. I cannot restore my Apps anymore. The only way to restore the backup is to use the INTERACTIVE MODE, which doesn't allow batch processing but it works as workaround.
Sent from my SM-G900F using XDA-Developers Legacy app

I suggest everyone to email the developer.
I've literally been pulling my hair out over the last 24hrs over this!
Flashed different ROMs, Restored my device to factory state, with no luck.

I've found a temporary fix for myself.
1)Settings--Google--Security and turn off verify apps.
2)Turn off verify apps over USB in developer settings.
3)Restore using Titanium.
4)Turn security settings back on.
It Seems google has beefed up their secuirity.
The Guys on the substratum theme thread are having a similar issue.
https://forum.xda-developers.com/apps/substratum/projekt-substratum-t3423623/page180
It seems to work on my Pixel, obviously each device has different settings.

Then i will change this to possible solution instead of just solution lol. Sorry guys. My solution still working for me though... Im using weta 4.7.3 rom. I cant confirm nor deny that google did something to alter the functionality since i didnt try to go back to a version of weta where TB worked fine. (and there is no way i will do that now lol. I still feel the pain of loosing all my data for good)

buzzboy said:
I've found a temporary fix for myself.
1)Settings--Google--Security and turn off verify apps.
2)Turn off verify apps over USB in developer settings.
3)Restore using Titanium.
4)Turn security settings back on.
It Seems google has beefed up their secuirity.
The Guys on the substratum theme thread are having a similar issue.
https://forum.xda-developers.com/apps/substratum/projekt-substratum-t3423623/page180
t seems to work on my Pixel, obviously each device has different setrings.
Click to expand...
Click to collapse
Uh yeah! Thank you. That's it! Good enough as workaround as we don't need to restore every day!
Sent from my SM-G900F using XDA-Developers Legacy app

buzzboy said:
I've found a temporary fix for myself.
1)Settings--Google--Security and turn off verify apps.
2)Turn off verify apps over USB in developer settings.
3)Restore using Titanium.
4)Turn security settings back on.
It Seems google has beefed up their secuirity.
The Guys on the substratum theme thread are having a similar issue.
https://forum.xda-developers.com/apps/substratum/projekt-substratum-t3423623/page180
It seems to work on my Pixel, obviously each device has different settings.
Click to expand...
Click to collapse
I was so pi$$$$$ed yesterday!! It just so happened that I was flashing a new ROM to my device yesterday (which I do waaaay too much, I think I have a problem lol) and suddenly wasn't able to restore anything through TiBU. I spent the better part of last night trying various things, all the while thinking that my device was seriously messed up this time!! Heh. I was kind of stressed. Just a tad. And I think I owe my wife some flowers after work today because she wasn't very happy with me for being on my phone all night, yelling and screaming and cussing... you get the idea I'm sure.
Anyway, this works in case anyone else needs confirmation. And for the record, I don't think this is an issue with TiBU because I even tried earlier builds. I agree with the others that it seems to have something to do with something Google implemented... Not very happy and seriously hope it's just a big oops that gets resolved soon. Either that, or TiBU gets updated to work-around the new security measures!

AthieN said:
I was so pi$$$$$ed yesterday!! It just so happened that I was flashing a new ROM to my device yesterday (which I do waaaay too much, I think I have a problem lol) and suddenly wasn't able to restore anything through TiBU. I spent the better part of last night trying various things, all the while thinking that my device was seriously messed up this time!! Heh. I was kind of stressed. Just a tad. And I think I owe my wife some flowers after work today because she wasn't very happy with me for being on my phone all night, yelling and screaming and cussing... you get the idea I'm sure.
Anyway, this works in case anyone else needs confirmation. And for the record, I don't think this is an issue with TiBU because I even tried earlier builds. I agree with the others that it seems to have something to do with something Google implemented... Not very happy and seriously hope it's just a big oops that gets resolved soon. Either that, or TiBU gets updated to work-around the new security measures!
Click to expand...
Click to collapse
Glad it helped. I too was a little stressed and my poor kids paid the price! I think I owe them a bag of sweets or two.
I've filled out a form to the developers with the possible fix and relevant commits needed to workaround this issue. Let's hope they pay attention.
Thanks to the OP for opening this thread in the first place.

buzzboy said:
Glad it helped. I too was a little stressed and my poor kids paid the price!
I've filled out a form to the developers with the possible fix and relevant commits needed to workaround this issue. Let's hope they pay attention.
Thanks to the OP for opening this thread in the first place.
Click to expand...
Click to collapse
No problem. My solution does not work for everybody. Im glad you found another way!! Im going to point people to the post of that solution so that they know. Thanks again:highfive:

buzzboy said:
Glad it helped. I too was a little stressed and my poor kids paid the price! I think I owe them a bag of sweets or two.
I've filled out a form to the developers with the possible fix and relevant commits needed to workaround this issue. Let's hope they pay attention.
Thanks to the OP for opening this thread in the first place.
Click to expand...
Click to collapse
Yes, definitely thanks to @jinkerz9430 as well!!

Just a little update, hopefully a fix will be here soon.

Anyone could just let me know how to turn this google security off using v20?
Please....

netgar said:
Anyone could just let me know how to turn this google security off using v20?
Please....
Click to expand...
Click to collapse
like bypassing the smart lock or prevent the google locked phone? if so just go to accounts on settings and go to google and then remove the account from the device. After that you can flash without remorse. :silly: . Although you can also flash with the google locked phone and still been able to bypass it.