Database Develop

security flaw on lockscreen

DISCLAIMER*** I DO NOT OWN A NEXUS 5, AND DO NOT FOLLOW IT HEAVILY THIS IS PURELY BASED ON MY EXPERIENCE TODAY AND MY YEARS OF USING ANDROID OS. I DO NOT USE IT DAILY AND ONLY USE IT EVERY NOW AND THEN FOR CALLS. MY INFORMATION MAY NOT BE ACCURATE AND PURELY BASED ON PREVIOUS USES OF DIFFERENT DEVICES FROM DIFFERENT BRANDS.
THIS MAY BE DISREGARDED OR/AND DELETED
Today my sister nexus 5 (aosp 5.1 "newest") was "stolen".
We spent the day looking all over the place for it and went back to a few stores we visited that day and asked the staff. But it was of no hope. No one has seen or heard of it, so we regarded it as stolen. So after awhile we went home we went to ADM (https://www.google.co.uk/android/devicemanager) and set up a lock and number to call as you would.
After a few hours my dad found it in his car :/ so yeah...
But that's just the bread of it. HERE is the butter:
1)The lock we set up was 100% not in place even tho ADM said it was "sent". AND the mobile data is ON, but this is just how ADM works and it doesn't check if the device receives it or not. Maybe google should add this feature.
BUT even after we got it back and connect to WIFI, the lock did NOT get put in place. Proving the phone does not check for any lock requests at screen unlock. But maybe because she already has a normal pincode in place and it couldn't over ride that :/
after that I took a interest in the security.
2)So i took a deeper look into the security and it flaw, and first off. EVEN locked I could access the status bar and turn on AIRPLANE MODE. This was without the password and I could turn on torch, wifi, mobile data ext off as well. The only thing I couldn't access was the "settings". But I had a great deal of control of the device's connectivity and from there a thief could make his way out without any calls or ANYTHING affecting him.
3)THIS was truly shocking. I'm not sure if this is by default or by accident. But by using the status bar "exploit" i was able to get into the users page and switch to guest mode. From there i was able to grant adb access and access the market. If this phone was rooted I guess you could install some apps to get rid of the lock screen or even install a custom recovery. But them i guess it's up to you to take the action.
As i said before. I do not use it. My sister does. But she does not root or mod, and only follows the AOSP path.
Some exploits may only work because of a few careless button presses. And may not even affect anyone at all if you don't spam the settings with random presses.
Thanks for listening to me and feel free to point out any mistakes i made and share if you could post if these "exploits" work for you. If someone already made a thread please delete this one. Thanks for listening

Actually the only serious thing is the guest mode option.. About the airplane mode, for a thief it would be much easier to simply turn the phone off.. Anyway I completely agree with you.. Google should take more seriously the security part.. It should even be impossible to turn off the phone without a code..

And make the back impossible to open so a thief can't pop out the battery.
Once a phone is out of your physical control, consider everything on it to be compromised, regardless of whatever security you have.

Please delete this. None of this is news or exploits. People have known and been disappointed by it from day 1 of Lollipop going live.

Well removing the battery of the n5 is not immediate.. If a thief want to resell it probably he won't do that until he's at home or wherever and if he couldn't turn it off you could track the position or at least erase your data..

91franz said:
Well removing the battery of the n5 is not immediate.. If a thief want to resell it probably he won't do that until he's at home or wherever and if he couldn't turn it off you could track the position or at least erase your data..
Click to expand...
Click to collapse
You say Google should take security more seriously. Take that advice. Never assume a thief would act in a manner that accommodates you.

That's right.. Anyway I should try to make his life as complicated as possible ?

It should even be impossible to turn off the phone without a code..

sseuorosal said:
It should even be impossible to turn off the phone without a code..
Click to expand...
Click to collapse
with some aluminium fold will easily to block any signal, the phone will eventually turn off.
p.s. If I am the thief which stole a useless phone, I will just break it and throw away. I don't think any thief will say "hey, I can't unlock it, let's return to the owner"

HELP : Phone asking for PIN instead of Fingerprints after MarshMallow update.

Hi,
I'm in need of help urgently!
Last week I had updated my Note 5 to MarshMallow and it was working fine. I remember the phone had never been off or restarted after the update until today when the battery ran out. Connected to charger and when I turned on the mobile it showed this message :
"Enter PIN instead of using fingerprint recognition after restarting device to protect fingerprints"
Now I've been unlocking screen using fingerprints from the time I got this phone. Unfortunately, I forgot the PIN and now I can't use fingerprints to unlock the screen. After a few failed attempts the wait time keeps increasing and now it has reached 30 minutes.
Is there anyway I can unlock my phone?
Please help ASAP!

Login into this website using your Samsung account
findmymobile.samsung.com/mindex.jsp
Find "Unlock my device" section
And make sure your device is connected to the internet then unlock you device

GreenXSI said:
Hi,
I'm in need of help urgently!
Last week I had updated my Note 5 to MarshMallow and it was working fine. I remember the phone had never been off or restarted after the update until today when the battery ran out. Connected to charger and when I turned on the mobile it showed this message :
"Enter PIN instead of using fingerprint recognition after restarting device to protect fingerprints"
Now I've been unlocking screen using fingerprints from the time I got this phone. Unfortunately, I forgot the PIN and now I can't use fingerprints to unlock the screen. After a few failed attempts the wait time keeps increasing and now it has reached 30 minutes.
Is there anyway I can unlock my phone?
Please help ASAP!
Click to expand...
Click to collapse
On the MM build, after a reboot you have to use the pin but subsequent times will be fingerprint, I have no idea why they did this. Sorry that happened to you, I have no idea how to get around that other than to keep searching, someone else had had that happen I'm sure.

Yep, I'm screwed, too...
I even kept a list of every iteration of PIN numbers I would ever use (they are generated by an algorithm). I have tried every one - and I am still locked out - with 60 minutes in between tries!
I have very, very important legal documents, notes, and recordings on my phone that I didn't get to backup yet. Unfortunately, most backups do not "dig" well enough under App directories to get all files generated by all Apps. So sad...
And "No", I can't access any sdcard or SIM bc it's an S6 edge+, and they are all locked into the case! The supposed Samsung "unlock" feature does not work, though it says it does.
Dying here! HELP...

Douglas333 said:
Yep, I'm screwed, too...
I even kept a list of every iteration of PIN numbers I would ever use (they are generated by an algorithm). I have tried every one - and I am still locked out - with 60 minutes in between tries!
I have very, very important legal documents, notes, and recordings on my phone that I didn't get to backup yet. Unfortunately, most backups do not "dig" well enough under App directories to get all files generated by all Apps. So sad...
And "No", I can't access any sdcard or SIM bc it's an S6 edge+, and they are all locked into the case! The supposed Samsung "unlock" feature does not work, though it says it does.
Dying here! HELP...
Click to expand...
Click to collapse
You're screwed really and this is why a lot of devs on here say to make backups! Your only option at this point is a firmware reinstall..

Rats! Catch 22...
MrMike2182 said:
You're screwed really and this is why a lot of devs on here say to make backups! Your only option at this point is a firmware reinstall..
Click to expand...
Click to collapse
But without root, I can't find a backup that will catch all the files well nested under App directories. With root, there are too many "gotchas" nowadays.
Besides, I know I have tried every PIN I would have ever set - so this MM "PIN" is a joke! There should have been a warning, as this is a serious disruption of service.
Wiping is just not an option - I have files created Friday, before the Upgrade, which would not have gotten backed up anyway. Besides, No update should block data access. One of you Gurus can't think of a workaround or push Samsung or Google for a fix? I'm thinking more like "Class Action Lawsuit" for disrupting normal access to my data and my lawsuit...
Anyone else that pissed?

Douglas333 said:
But without root, I can't find a backup that will catch all the files well nested under App directories. With root, there are too many "gotchas" nowadays.
Besides, I know I have tried every PIN I would have ever set - so this MM "PIN" is a joke! There should have been a warning, as this is a serious disruption of service.
Wiping is just not an option - I have files created Friday, before the Upgrade, which would not have gotten backed up anyway. Besides, No update should block data access. One of you Gurus can't think of a workaround or push Samsung or Google for a fix? I'm thinking more like "Class Action Lawsuit" for disrupting normal access to my data and my lawsuit...
Anyone else that pissed?
Click to expand...
Click to collapse
You need to learn to "manually" back your stuff up yourself and don't rely on any programs/apps to do it...
There's seriously nothing the dev community could do because for 1 it's not the right way to go about this because if someone's phone is stolen or whatever basically they'd be able to come to XDA-Developers and find a way around the phone being locked for 2 that's definitely not what devs do, we don't look for ways to break into a phone or circumvent the security. You should have backed up anything you knew was important, simple as that .. You need to factory reset at this point. Sorry.

Find My Device

Out of curiosity, I tried Google’s Find My Device and it worked very well with one (I think) major fault. As soon as I tried it, a notification appeared on my phone, Device located, Find My Device located this device.
Now to me, it seems silly for the phone to advertise the fact that it has been found to any thieves.
So far I haven’t found a way to turn it off.
Anyone know a way around it please?
Best regards,

Do not worry to much as I do think - it will need root to disable this , but maybe Im wrong ?
In my logic thieves know about phone tracking as it is nothing new it was with the android for years . Iphone etc
When thieves stole the phone I think they will turn off the phone + second the phone will go to flasher to clean from google accounts etc to make as reset phone
and from then Phone can go to overseas market so if it is stolen and you have reported IMEI they can use in other country
Security for me is to keep all my data on phone encrypted so than if phone stolen or reset there will be no my data my contacts pictures messages etc Phone is hardware yes will be sad if stolen , but images messages is my life and to find some information on you tube or naked pictures on net can change life forever

skypekestutiss said:
Do not worry to much as I do think - it will need root to disable this , but maybe Im wrong ?
In my logic thieves know about phone tracking as it is nothing new it was with the android for years . Iphone etc
When thieves stole the phone I think they will turn off the phone + second the phone will go to flasher to clean from google accounts etc to make as reset phone
and from then Phone can go to overseas market so if it is stolen and you have reported IMEI they can use in other country
Security for me is to keep all my data on phone encrypted so than if phone stolen or reset there will be no my data my contacts pictures messages etc Phone is hardware yes will be sad if stolen , but images messages is my life and to find some information on you tube or naked pictures on net can change life forever
Click to expand...
Click to collapse
Easily solved by not keeping naked images of yourself on the phone :laugh:
But in any case, seeing naked images of me won't ruin my life, it will ruin thieves'!

When the device located notification shows long press on it, it will take you to app info, turn off notifications, all of them for the app.
Sent from my SM-N950U using XDA-Developers Legacy app

Craniotomy said:
When the device located notification shows long press on it, it will take you to app info, turn off notifications, all of them for the app.
Sent from my SM-N950U using XDA-Developers Legacy app
Click to expand...
Click to collapse
Many thanks, will try that.
Best regards,
Thank you for the most useful answer. It worked!

I use where's my Droid for this as you can simply sms the phone to wake it up

Question i just changed my pattern lock on my s21 ultra and forgot it. help please!

omg.
my friend just seen my pattern when i unlocked my phone so i decided to change my pattern (it had been a real long time since i changed it anyway) so i did it.
i cant remember what i changed it to.
i actually changed it 2x but the first pattern i thought was too easy so i changed it again.
i didnt make it any harder as in more dots to complete the pattern but hard enough i dont remember it.
im on a s21 ultra of course.
is there a limit on how many failed attempts i can do?
so far i think im under 10 but it does make me wait 30secs alot.
if there is an unlimited amount i think i will guess it but if there is a finite i dont want to mess it up and do a factory reset or erase.
i have alot of my grandbabies pics and videos on there.
if there is a way to bypass it please tell me.
i know my google acct on computer etc... thats not a problem and that is the same acct on my phone.

en11gma said:
omg.
my friend just seen my pattern when i unlocked my phone so i decided to change my pattern (it had been a real long time since i changed it anyway) so i did it.
i cant remember what i changed it to.
i actually changed it 2x but the first pattern i thought was too easy so i changed it again.
i didnt make it any harder as in more dots to complete the pattern but hard enough i dont remember it.
im on a s21 ultra of course.
is there a limit on how many failed attempts i can do?
so far i think im under 10 but it does make me wait 30secs alot.
if there is an unlimited amount i think i will guess it but if there is a finite i dont want to mess it up and do a factory reset or erase.
i have alot of my grandbabies pics and videos on there.
if there is a way to bypass it please tell me.
i know my google acct on computer etc... thats not a problem and that is the same acct on my phone.
Click to expand...
Click to collapse
Do you have a Samsung account on it?

Kenora_I said:
Do you have a Samsung account on it?
Click to expand...
Click to collapse
i not sure. i think i might have but i think i deleted it but it keeps asking me to same my passwords to samsung and i keep hitting never.

unless you have an unlocked bootloader I don't know that there's anything that can be done. I would just get them all wrong at this point and see if it let's you reset it with a good account. If you BL is unlocked you could boot into a custom recovery and wipe the security file.

en11gma said:
i not sure. i think i might have but i think i deleted it but it keeps asking me to same my passwords to samsung and i keep hitting never.
Click to expand...
Click to collapse
Can only be done if you have find my device enabled and have an active internet connection in the phone tho
Step 1. Open the internet browser on your notebook and input the following website
address: https://findmymobile.samsung.com, click on the Sign in button and input your login credentials of your Samsung account, then click on Sign in button once more.
image to login to find my mobile web page
Step 2. The mobile device registered under your Samsung account will appear on the right-side of the screen. If you have multiple devices registered under the same Samsung account, make sure you select the device that needs to be remotely unlocked. Refer to the image below and click on the Unlock icon to unlock your device.
image after login to find my mobile web page
Step 3. Once you click on Unlock, a pop-up window will appear asking to verify the password of your Samsung account. After you input your password, click on the NEXT button, the pop-up window will automatically close and another pop-up window will appear with the result of remotely unlocking your device

orangekid said:
unless you have an unlocked bootloader I don't know that there's anything that can be done. I would just get them all wrong at this point and see if it let's you reset it with a good account. If you BL is unlocked you could boot into a custom recovery and wipe the security file.
Click to expand...
Click to collapse
i just logged into my samsung account and it says i have no linked devices.
grrrr
is there a limit before it factory reset my phone

Kenora_I said:
Can only be done if you have find my device enabled and have an active internet connection in the phone tho
Step 1. Open the internet browser on your notebook and input the following website
address: https://findmymobile.samsung.com, click on the Sign in button and input your login credentials of your Samsung account, then click on Sign in button once more.
image to login to find my mobile web page
Step 2. The mobile device registered under your Samsung account will appear on the right-side of the screen. If you have multiple devices registered under the same Samsung account, make sure you select the device that needs to be remotely unlocked. Refer to the image below and click on the Unlock icon to unlock your device.
image after login to find my mobile web page
Step 3. Once you click on Unlock, a pop-up window will appear asking to verify the password of your Samsung account. After you input your password, click on the NEXT button, the pop-up window will automatically close and another pop-up window will appear with the result of remotely unlocking your device
Click to expand...
Click to collapse
i have 4 devices in there but not the one im using. crap!
do i have unlimited failed attempts on the pattern unlock?

en11gma said:
i just logged into my samsung account and it says i have no linked devices.
grrrr
is there a limit before it factory reset my phone
Click to expand...
Click to collapse
Well, at this point you probably need to reset the phone, as you didn't link your Samsung account.
There actually isn't any way to recover the data Unless you can guess the pattern again.
I don't know if Samsung themselves would unlock the phone if you took it to the support center providing proof that you own the phone, but that could get your data back idk
In my opinion it is worth a try in this case

Kenora_I said:
Well, at this point you probably need to reset the phone, as you didn't link your Samsung account.
There actually isn't any way to recover the data Unless you can guess the pattern again.
I don't know if Samsung themselves would unlock the phone if you took it to the support center providing proof that you own the phone, but that could get your data back idk
In my opinion it is worth a try in this case
Click to expand...
Click to collapse
do i have unlimited tries on the pattern unlock or will it erase my data after so many failed attempts?

en11gma said:
do i have unlimited tries on the pattern unlock or will it erase my data after so many failed attempts?
Click to expand...
Click to collapse
Depends if you had that option enabled in settings, by default it is disabled

en11gma said:
omg.
my friend just seen my pattern when i unlocked my phone so i decided to change my pattern (it had been a real long time since i changed it anyway) so i did it.
i cant remember what i changed it to.
i actually changed it 2x but the first pattern i thought was too easy so i changed it again.
i didnt make it any harder as in more dots to complete the pattern but hard enough i dont remember it.
im on a s21 ultra of course.
is there a limit on how many failed attempts i can do?
so far i think im under 10 but it does make me wait 30secs alot.
if there is an unlimited amount i think i will guess it but if there is a finite i dont want to mess it up and do a factory reset or erase.
i have alot of my grandbabies pics and videos on there.
if there is a way to bypass it please tell me.
i know my google acct on computer etc... thats not a problem and that is the same acct on my phone.
Click to expand...
Click to collapse
Your only solution is too wipe your phone. So take better care next time and chalk this one up to experience

jrkruse said:
Your only solution is too wipe your phone. So take better care next time and chalk this one up to experience
Click to expand...
Click to collapse
Samsung might unlock it at their support centers yknow if they have proof of ownership

Kenora_I said:
Depends if you had that option enabled in settings, by default it is disabled
Click to expand...
Click to collapse
so how many failed attempts do i get?

en11gma said:
so how many failed attempts do i get?
Click to expand...
Click to collapse
Probably 3 then a waiting time, but it's probably more easier to take it to Samsung and get them to unlock it for you, since you own the phone they can do it.

Kenora_I said:
Samsung might unlock it at their support centers…..
Click to expand...
Click to collapse
Yea I wouldn’t hold my breath on that happening but good luck

Kenora_I said:
Probably 3 then a waiting time, but it's probably more easier to take it to Samsung and get them to unlock it for you, since you own the phone they can do it.
Click to expand...
Click to collapse
i live in the country. i dont think there is a samsung store even in my state. im in iowa in usa

Samsung can't unlock it... pretty sure.
Once you set a lock screen the security is very good, too good. Sleep on it to see if the pattern comes to you... you still remember it.
That failing, suck it up. It may have not been your fault at all, see below.
I never set a screen lock, 2x tap on/off.
Never set a a bios password.
And most importantly never encrypt data backup hdds, etc.
You are the one most likely to get locked out... lesson learned the hard way.
A firmware failure, or external forces beyond your control (high energy particles of cosmic origin can do it*) can put you in a no win situation once you set an eccess password. While if you hadn't you likely wouldn't be locked out. I had a laptop bios lock me out, the password was simple a simple "S" even years latter I remember it... but the bios doesn't!
*this isn't a joke. Flying or being at higher elevations increases the risk. While it is slight when under the protection of the ionosphere it's still a random failure factor. One high energy particle can change the value of a flash memory cell without damaging it. The data however is corrupted unless redundantly backup which is one reason why spacecraft use at least 3 redundant computers.

blackhawk said:
Samsung can't unlock it... pretty sure.
Once you set a lock screen the security is very good, too good. Sleep on it to see if the pattern comes to you... you still remember it.
That failing, suck it up. It may have not been your fault at all, see below.
I never set a screen lock, 2x tap on/off.
Never set a a bios password.
And most importantly never encrypt data backup hdds, etc.
You are the one most likely to get locked out... lesson learned the hard way.
A firmware failure, or external forces beyond your control (high energy particles of cosmic origin can do it*) can put you in a no win situation once you set an eccess password. While if you hadn't you likely wouldn't be locked out. I had a laptop bios lock me out, the password was simple a simple "S" even years latter I remember it... but the bios doesn't!
*this isn't a joke. Flying or being at higher elevations increases the risk. While it is slight when under the protection of the ionosphere it's still a random failure factor. One high energy particle can change the value of a flash memory cell without damaging it. The data however is corrupted unless redundantly backup which is one reason why spacecraft use at least 3 redundant computers.
Click to expand...
Click to collapse
omg wut ._.

Even if u hard reset, u will be asked to input your Samsung account and password, anf even with out knowing the pattern you have the option of putting in your PIN.
If you don't know your own PIN code then, something Is wrong!

death365 said:
Even if u hard reset, u will be asked to input your Samsung account and password, anf even with out knowing the pattern you have the option of putting in your PIN.
If you don't know your own PIN code then, something Is wrong!
Click to expand...
Click to collapse
It would be Google account and they said they changed their pattern and lost the combination, i also have had the same problem b4. I just used find my phone to unlock the device

Can't Unlock Samsung S10 - forgot pattern

I'm really hoping someone can help me. I have the Samsung S10 from Verizon, and recently had to change my lock pattern (to unlock the phone to be able to do anything). I did it late at night and honestly can't remember what pattern I set up. I have fingerprint and facial recognition setup, but it doesn't even attempt those, as if it isn't an option at this point. Right now, each time I attempt to unlock my phone, it won't allow me to try again for over an hour, and it adds on more time each time I mess up the pattern. I've called Verizon and Samsung. Verizon told me that I had to call Samsung, and Samsung said they couldn't help me. The closest Verizon store is about 1.5 hours away. I'll probably try to go tomorrow if I don't get anywhere. But so far, it isn't looking good, and this is insane to me. I can't believe no one can help me get into my phone. But then I remembered these forums have been EXTREMELY helpful in the past. I'm wondering if anyone has a solution or can offer some help. I've considered rooting the phone (or whatever people call it these days) but that will void my warranty. I was dumb enough to have never written down passwords, so I pretty much can't access any website (that requires a username and password) because all my info is stored in my phone. I can't even get into my email. If any of you great people think you can help me out, I'm open to all suggestions! Thank you!

emmiejolopez said:
I'm really hoping someone can help me. I have the Samsung S10 from Verizon, and recently had to change my lock pattern (to unlock the phone to be able to do anything). I did it late at night and honestly can't remember what pattern I set up. I have fingerprint and facial recognition setup, but it doesn't even attempt those, as if it isn't an option at this point. Right now, each time I attempt to unlock my phone, it won't allow me to try again for over an hour, and it adds on more time each time I mess up the pattern. I've called Verizon and Samsung. Verizon told me that I had to call Samsung, and Samsung said they couldn't help me. The closest Verizon store is about 1.5 hours away. I'll probably try to go tomorrow if I don't get anywhere. But so far, it isn't looking good, and this is insane to me. I can't believe no one can help me get into my phone. But then I remembered these forums have been EXTREMELY helpful in the past. I'm wondering if anyone has a solution or can offer some help. I've considered rooting the phone (or whatever people call it these days) but that will void my warranty. I was dumb enough to have never written down passwords, so I pretty much can't access any website (that requires a username and password) because all my info is stored in my phone. I can't even get into my email. If any of you great people think you can help me out, I'm open to all suggestions! Thank you!
Click to expand...
Click to collapse
I’ve never had a problem like this, so solutions I can only be guessed at.
Try install Stock ROM with Odin. Download last version with Frija. You will lose all settings and Android will be installed at the factory settings. I think you can turn off your phone, enter the Download mode and install Android with Odin. Or if you can enter Recovery mode, go to wipe data / factory reset and restart phone. I don't think you will lose your phone warranty.

emmiejolopez said:
I'm really hoping someone can help me. I have the Samsung S10 from Verizon, and recently had to change my lock pattern (to unlock the phone to be able to do anything). I did it late at night and honestly can't remember what pattern I set up. I have fingerprint and facial recognition setup, but it doesn't even attempt those, as if it isn't an option at this point. Right now, each time I attempt to unlock my phone, it won't allow me to try again for over an hour, and it adds on more time each time I mess up the pattern. I've called Verizon and Samsung. Verizon told me that I had to call Samsung, and Samsung said they couldn't help me. The closest Verizon store is about 1.5 hours away. I'll probably try to go tomorrow if I don't get anywhere. But so far, it isn't looking good, and this is insane to me. I can't believe no one can help me get into my phone. But then I remembered these forums have been EXTREMELY helpful in the past. I'm wondering if anyone has a solution or can offer some help. I've considered rooting the phone (or whatever people call it these days) but that will void my warranty. I was dumb enough to have never written down passwords, so I pretty much can't access any website (that requires a username and password) because all my info is stored in my phone. I can't even get into my email. If any of you great people think you can help me out, I'm open to all suggestions! Thank you!
Click to expand...
Click to collapse
Hi Emmie, I have exactly the same problem with my S10+ in the UK. Created my pattern late last night and forgot it too! Samsung here are saying they can't do anything except a factory reset but I have around 15,000 pics/vids saved! I'm happy for it to sit there for years whilst a solution is found as long as I don't lose my data. I don't understand why face recognition stopped working nor why it keeps increasing the time between attempts. I hope nothing worse happens as it doesn't warn how many attempts I have left so I just keep trying every 17 minutes now!