Bypass Android Lock Screen on Pixel and Other Devices

Nov 18, 2022 | Blog

David Schütz, a cybersecurity researcher, inadvertently discovered a means to circumvent the lock screen on his fully updated Google Pixel 6 and Pixel 5 devices, allowing anybody with physical access to the smartphone to unlock it.

Bypassing the lock screen on Android smartphones is a straightforward five-step method that should only take a few minutes.

Google repaired the security flaw in the latest Android version issued last week, although it has been exploitable for approximately six months.

Inadvertent discovery

Schütz claims he found the weakness by accident after his Pixel 6 ran out of power, he proceeded to mistype his PIN three times, and then he used the PUK (Personal Unblocking Key) code to unlock his SIM card.

After unlocking the SIM and entering a new PIN, the device did not prompt him for the lock screen password, instead requesting a fingerprint scan.

For security reasons, Android smartphones usually request a lock screen password or pattern upon startup; thus, moving directly to fingerprint unlock was unusual.

The researcher kept investigating, and when he tried duplicating the weakness without rebooting the device, he realized it was feasible to skip the fingerprint as long as the owner unlocked it at least once since the reboot.

This security vulnerability has a broad impact, including all devices running versions of android 10, 11, 12, and 13 that have not applied the November 2022 patch.

Having physical access to a device is an essential requirement. However, the vulnerability can have serious consequences for persons with violent relationships, anyone under law enforcement investigation, owners of stolen electronics, and so on.

To gain unrestricted access to the victim’s smartphone, all the attacker needs to do is utilize their own SIM card on the target device, input the incorrect PIN three times, and supply the PUK number.

Patching by Google

The problem is caused by the keyguard being incorrectly terminated following a SIM PUK unlock.

When Schütz input the right PUK number, two separate components called a dismiss function; one that constantly keeps tabs on the SIM state and another that handles PUKs. This resulted in the dismissal of the PUK security screen and the following security screen in the stack.

The user would go straight to the home screen if there were no additional security screens.

Google received the vulnerability report from Schütz in June 2022, and while they accepted it and gave it the CVE ID CVE-2022-20465, they didn’t make a remedy available until November 7, 2022.

To solve this problem, Google has added a new argument to every “dismiss” call that specifies the security technique being used, allowing “dismiss” calls to be used to dismiss only certain security screens rather than the next one in the stack.

Despite Schütz’s report being duplicated, Google made an exception and paid the researcher $70,000 for his discovery.

Android 10, 11, 12, and 13 users may fix this problem by installing the November 7, 2022, security update.

FBI Program Tasked with Infrastructure Security Compromised

FBI Program Tasked with Infrastructure Security Compromised

The FBI program tasked with ensuring critical infrastructure security has been compromised by hackers, who now offer access to the program's data on the dark web. The breach was initially disclosed by Brian Krebs of Krebs on Security, who claims that the data was for...

Streamline Your Business with the Latest Smart Home Technology

Streamline Your Business with the Latest Smart Home Technology

Are you a business owner looking to get the most out of your Google smart home devices? If so, you're in luck! Google has enabled its Nest products and Android OS with the initial rollout of the Matter smart home standard. This means that businesses now have the...

Data Breach at Sequoia One Exposes Sensitive Customer Information

Data Breach at Sequoia One Exposes Sensitive Customer Information

What do you do when your most personal information has been compromised? This is likely the question that customers of Sequoia One asked themselves earlier this month as they were informed that the company had been hacked. Sequoia One specializes in the management of...

Cisco Reports Critical IP Phone Vulnerability

Cisco Reports Critical IP Phone Vulnerability

As a business owner, it's important to stay informed about potential vulnerabilities that could impact your organization. Recently, Cisco reported a critical vulnerability, tracked as CVE-2022-20968, affecting its IP Phone 7800 and 8800 Series. This new vulnerability...

Google Chrome Releases Two New Features

Google Chrome Releases Two New Features

Google Chrome is one of the more commonly used web browsers. Over the years, though, Chrome has gained a reputation for utilizing a large portion of a computer's memory. This can be a problem if you're running other resource-intensive tasks and don't want to slow...

Get a Free Consultation


Fill out the form below to receive a free consultation and learn how we can make your technology worry-free!


Contact Information

  • 39301 Badger Street, Suite 500
    Palm Desert, CA 9221
  • (760) 333-8523