花卷说科技

Forwarded from Abhishek mishra

Bug found in Android lets you unlock someone's device just a SIM card
Source

A recently disclosed vulnerability gives any attacker with physical access to your Android device the ability to unlock it.

All devices running Android 10 to Android 13 were affected with this bug whether they are running OneUI, MIUI or even Pixel's stock OS. Custom ROMs are also affected by it.

The attacker only needs a SIM card with the PIN and PUK code to run this exploit. PUK (Personal Unlocking Key) is an 8-digit code unique to your SIM card. It is used to unlock your mobile and reset your SIM PIN.

The vulnerability is tracked with CVE-2022-20465 with patches for this issue being now available for AOSP 10-13.

The security researcher reported this bug to Android’s Vulnerability Rewards Program in the middle of this year, but Google did not move on the issue until September after some in-person prompting. It resulted in a $70,000 reward and is listed in the November security patch under a “System” issue with “High” severity.

YouTube

Pixel 6 Full Lockscreen Bypass POC

Accompanying blog post: Accidental $70k Google Pixel Lock Screen Bypass
https://bugs.xdavidhu.me/google/2022/11/10/accidental-70k-google-pixel-lock-screen-bypass/

I found a vulnerability affecting seemingly all Google Pixel phones where if you gave me any…

www.tgoop.com/technical_with_love/570

1.5K viewsNov 11, 2022 at 05:28

Bug found in Android lets you unlock someone's device just a SIM card
Source

A recently disclosed vulnerability gives any attacker with physical access to your Android device the ability to unlock it.

All devices running Android 10 to Android 13 were affected with this bug whether they are running OneUI, MIUI or even Pixel's stock OS. Custom ROMs are also affected by it.

The attacker only needs a SIM card with the PIN and PUK code to run this exploit. PUK (Personal Unlocking Key) is an 8-digit code unique to your SIM card. It is used to unlock your mobile and reset your SIM PIN.

The vulnerability is tracked with CVE-2022-20465 with patches for this issue being now available for AOSP 10-13.

The security researcher reported this bug to Android’s Vulnerability Rewards Program in the middle of this year, but Google did not move on the issue until September after some in-person prompting. It resulted in a $70,000 reward and is listed in the November security patch under a “System” issue with “High” severity.

BY 花卷说科技