The Accidental $70k Android Hack

[@Username-qx9gk]

The way that was handled, almost sounds like he discovered a feature..

[@nfg_fpv]

somehow that doesn't sound implausible 🤔

[@ologhai8559]

putting on my tinfoil hat.... a govermemt glowie feature

[@MM-24]

I'm sure it was actively being used by a 3 letter agency, likely in an active operation we'll hear about decades from now

[@interstellarsurfer]

@@MM-24 You won't hear about it.

[@khazsilverstar]

Exactly my thoughts!

[@medea27]

Ridiculous that David had to go to that extreme to get Google to move on it... can't say I'm entirely surprised though. And the reflection in someone's glasses is a big security problem if you consider that many people log into secure internal systems during video-conferences. The info on their screen could be all sorts of data... from login details to customer private data to confidential business info. Even worse if someone hacks into their webcam when they _aren't_ on a video call & can observe whatever they are working on.

[@MM-24]

Yes, everyone knew that, the way google acted. Likely, this "vulnerability" was being used in the spy community, and this revelation was probably going to mess up some crucial active operation

[@dealloc]

Use a password manager and signed certificates for internal systems.

[@DrDipsh1t]

I've personally used people's glasses reflection for my own benefit in the past playing Yu-Gi-Oh as a kid lol. I could see their hand and use that info to play accordingly. Fun times 😂

[@TheSimoc]

Only thing I find surprising in the case was that Google finally received the customer feedback and even bothered to fix the issue. Usually, Google hasn't given a shit about customer feedback nor particularly cared about issues in their products.

[@JohnDoe-sp3dc]

Update your body's firmware and get lasik surgery: bug patched 👍

[@byteragex]

I guess lock screen bypass was google's backdoor otherwise who would not take such critical yet easy vulnerability seriously 😁

[@dev-debug]

Yeah was wondering the same thing. Would not be the first software caught with a backdoor.

[@TheSimoc]

Nah, Google has just never given a shit about their shitty products full of bugs, bloat, horrible UIs, and constant API changes for sake of change and keeping devs busy.

[@Whatthellisthisthing]

I remember this CS:GO streamer was using wall hacks and you could see it in the reflection of his sunglasses lol

[@the-matrix-has-you]

It has nothing to do with it🤣🤣🤣 you saw someone using csgo hack thats all

[@Gamer-ct6hb]

@@the-matrix-has-you I mean it kinda does have to do with the video. This comment is pretty funny!

[@garneet]

@@the-matrix-has-you i mean its literally also reflection in sunglasses, so its somewhat related

[@anteshell]

@@the-matrix-has-you It has everything to do with it. The topic was literally recognizing what's on the screen through the reflection on the specs, which is exactly what happened in the situation OP describes. I mean how dumb you have to be to not understand it? *facepalm

[@the-matrix-has-you]

@@garneet ok let me summarize what happened in video guy has input his pin code 3 times locks himself out of system and only way to gain Access again is a PUK code he put the PUK Code in but Android is hanging and not showing the security password area right so he tried the same procedure again to repeat the process after that he knew that he has found a bug in Android system so the videos Topic is a bug in Android System on Google Pixel Phones. Not about some CSGo lamer who is using wallhack and getting busted cause he was just dumb enough to wearing glasses while recording himself... I dont see a similarity between if you can see one you might be high Stop using it bro🤣🤣🤣

[@thethiny]

It's worth mentioning that the sim attack does not "Decrypt" your phone, that's why the phone has to be on and not rebooted. Decryption happens on first entry after boot only. Afterwards it's just a password.

[@QualityDoggo]

Thanks

[@TheSimoc]

I didn't get your point. In the video the phone *was* rebooted if I got it right?

[@thethiny]

@@TheSimoc he showed that when it rebooted it got stuck forever.

[@TheSimoc]

@@thethiny Yeah, had to rewatch the video.. actually there are severe gaps on the story.. Indeed the phone got "stuck forever" in first place when he needed to enter the PUK due to forgotten PIN. Then, there was never mentioned any of those very relevant things: - Why did that happen. It surely should have shown the lock screen. - How did he get the phone working then. Supposedly by rebooting, which leaves the aforementioned as a mystery occurence, and subsequent details untold.

[@thethiny]

@@TheSimoc 1- this was the bug. When you enter sin pin code it takes you home and forgets to check lock screen, since lock screen is no longer needed after first unlock. 2- He said (original guy, not video) that it was his phone so he knew the password.

[@mineisstupid]

tried it on my Pixel 4a 5G... even though it said that this bug was discovered on Pixel 6 & 5, apparently it does work for older phones as well

[@fliporflop7119]

bugs are backwards compatible

[@oqocraft2661]

just like modern phones can be destroyed with a tank, old phones can be destroyed too

[@frankserafin9207]

@@fliporflop7119 not all bugs are backwards compatible

[@mateuszzimon8216]

I tried this on my S10E Samsung and on October patch was still working, on November patch not. If u don't get patch u already screwed

[@Sprinkles-r5y]

I was reading about this yesterday, I hadn’t thought about PUK codes for over 10 or 15 years until then. I wonder what made him even think of trying it, I don’t even know my current PUK code tbh. Great explainer, especially happy you shared this as it exposes how much google dragged their feet with this.

[@vgamesx1]

Yeah, it really shows how much any company actually cares whenever they talk about security or keeping users safe, then they proceed to give everyone an annoyed sigh saying they'll fix their problems.

[@ezra1369]

Might be intentional

[@key_gen]

They could just reply to every bug reporter that their find was duplicate, nothing really stops it. Glad he got rewarded though

[@ekremaslan8068]

Many people announcing that would just decrease their credibility. So they can't abuse that. There is nothing stopping them from using it occassionally though.

[@MM-24]

I'm sure this was actually made by design, they were gently trying to communicate that it's likely being used actively by some 3 letter agency to defend the world or save Ukraine

[@chri-k]

@@MM-24 or likely neither of those

[@mrkiky]

You should tell them you have the bug and then arrange the payment legally at a notary if they're interested before you demonstrating it.

[@ro0b0]

Eventually people would just stop reporting bugs, it's much better for them to spend a tiny fraction of their yearly profits on paying out bug bounties. 70k is literally nothing to Google

[@jaesen737]

Woah im early

[@swiftsilver]

this has been a persistent issue in android since like 7 or 8. People have been using it to bypass factory reset protection (referring to sim card pins in android in general)

[@roberteischen4170]

"Let me know if your phone is vulnerable." Nice try glowie

[@DesertCookie]

0:55 Your phone doesn't ask for the SIM pin code? Every phone I've ever owned in Germany has this as a feature I cannot turn off. TIL I guess.

[@chri-k]

you can remove the SIM PIN code, then the phone won’t ask for ot

[@DesertCookie]

@@chri-k Why would you though, I wonder.

[@nathnathn]

The reflections thing has been done if not with glasses before. I.e window reflections on security cam’s. Its not a generally reliable tactic beforehand but has popped up for finding identifying information before.

[@forestcityfishing4749]

Thats cute that you think police do any investigating.

[@nathnathn]

@@forestcityfishing4749 you do know places other then the US exist?. Though we do have our own corruption issues here there nothing like in the US.

[@anon_y_mousse]

@@nathnathn It's cute that you think he was talking about the US. It's a universal fact amongst humans, they're lazy. I wouldn't call it corruption per se, but it's a select few that actually do their job and investigate crimes. The majority of good cops are beat cops who aren't even allowed to do the investigating and the actual detectives just halfass it. It's also cute that you think corruption is worse in the US than literally everywhere else.

[@Bashiroo]

Geez, that bug was present on my first Android phone that was running on 4.0.4, though. Restart, sim code, and you didn't need a password to access the phone. I wish I knew that I could get 70k for that.

[@OfficialPooYT]

This has been a back door for android for a few years now, there are videos going far back on how to bypass 🔒 with the same sim method

[@SDogo]

or the one with the speech assistant and the help links that open chrome XD

[@OfficialPooYT]

@@SDogo many have came and gone, rip exploits 😂

[@mateuszzimon8216]

@@SDogo yes but they need AFU mode to work. This work in BFU.

[@jacksoncremean1664]

A patch for this was already developed by the Graphene OS team on June 13 but google didn't accept the patch.

[@DarklinkXXXX]

That's pretty cool. Do you know what codebase has the lock screen? Kinda wanna see it now.

[@iPeaked]

I was able to recreate this on 2 different Samsung devices sooo....

[@veritas-truth5851]

I think if companies did try to start checking glasses reflections to monitor what their users are doing it could potentially be seen as a form of discrimination based on someone's health and land companies in some legal troubles

[@saviorvx1883]

shix its not a thing yet , and ppl already label it a discrimination., companies don't gotta go this far to know wassup ,they'll just mandate software/keyloggers only staLKers would go this far and also measure the shadow of sunlight.etc..... we're fuxked as a species , when ppl are on crack all day to be this woke about everything

[@GainingDespair]

This doesn't seem like an bug, it bypasses encryption .....

[@ekremaslan8068]

"It is not a bug, it is a feature."

[@geroffmilan3328]

If Project Zero can do 90-day deadlines, so can we. Probably right call to accept their release date, but also the right move to inform a vendor that public interest means you will disclose if they do not respond.

[@jul13n]

My oneplus 7 pro with android 11 and security patch from June 2022 is not vulnerable to the lockscreen bypass.

[@bamgm14]

Interestingly, my phone Realme X7 with it's Android splinter also had this bug however, the moment you got into the main page however, it would immediately kick you off the page and send you back to lockscreen

[@mateuszzimon8216]

And this is proper, on Samsung S10e also show u main but lock you up after any interaction even plugin USB device.

[@OcteractSG]

I kind of like the idea of having to wear polarizing glasses just to view what’s in the screen. I suppose that would be a mitigation to the reflection problem, though it’s still uncommon.

[@isaackingvideos]

Wow!!! "Google phone 7 has amazing security"

[@20Rewind]

Hacker: Spends days of there time trying to find a vulnerability. Random researcher: oh nonono 🤣

[@rp479]

Get off TikTok bud

[@20Rewind]

@@rp479 huh?

[@MTS_IT]

i have potatovision 480p camera from 2000-2010 era (more or less) - i'm safe :)

[@isthatso1961]

What if Google intentionally left the backdoor for govt? That's why they didn't fix it in time.

[@Ethorbit]

I've always disliked Android's lock screen security, it honestly seems like older models can do it better while newer ones are setup in a way that favors the gov in case they need to break into your device

[@arcticcircle9178]

Why do you say that?

[@pingyong6940]

The $70k look almost like a bribe to shut up. The act doesn't seem to be doing the right thing. If it was, then what with the silence treatment, no actions to fix, and the so-called "duplication" report.

[@___DRIP___]

I remember similar exploits like this on the Galaxy S7.

[@user-28qhfk65]

Im using s7 edge right now, can you tell me how you did it?

[@crispywings9066]

Thank you for the informative video

[@DaHaiZhu]

Astrophotographers use that same technique of overlaying hundreds of images to produce a single sharp image of a planet or nebula. Its not that far fetched (pun intended)

[@anteshell]

Actually, no. The process is significantly different both on what the source material is and how to get to the final result. The idea is the same, but the practical application is nothing alike.

[@n00n1n]

$70,000? Holy shit, I mean it's Google, they basically print money.He had to be losing his mind once he got that email $70,000 babay

[@xxxx-ey7rp]

😂😂😂

[@swaggamesph3342]

This bypass even if release without a patch, will still need a working puk code though, which only telecom providers have access to.

[@seraphina985]

It is also included on the plastic card you have to punch the sim out of when you get it, also bear in mind the sim card lock and the PUK is tied to the SIM. Thus you do not need access to their SIM's PUK code, you simply need to be in possession of both the phone and a SIM with a sim lock set that you have the PUK code for, simply swap that in and bingo. Granted this doesn't let you bypass any SIM lock on their card so no sending or receiving future calls or texts to their number. But it does give you access to all data stored on the phone including any and all stored credentials with that information a social engineering attack on the mobile network to request a sim swap is likely to succeed in getting you the former too. Those credentials are likely to include sites that contain all of the customers personal information which could be used to trick customer service into believing you are them. You would likely be able to provide full name, address, phone numbers, email addresses, and likely answer detailed specific questions about their billing history with the phone company if they have their app installed etc, also last 4 digits of payment cards and bank accounts is likely to be available too. Suffice to say that is exactly the sort of information you need to get around phone based identity verification pretty much.

[@midimusicforever]

Big L for Google that they didn't handle it better.

[@amir3515]

No one is perfect

[@IShowVelocity.]

Theory: google actually put this as a backdoor access feature

[@ecodev15]

this doesnt seem to be an "encryption bypass" the device has to be in AFU to be unlocked (aka, after it has been decrypted in ram) as seen, when the device is in BFU (right after booting) it is not vulnrable to this, and just glitches out since it doesnt know how to decrypt the phone.

[@mateuszzimon8216]

U don't need AFU, if u hear this after battery was depleted.

[@MMOStars]

My phone has like 10 Chinese malwares running on it, so this has to be the least of my worries at this point 😅

[@bokexd3173]

I just tried it on Redmi Note 7 Global on Lineage OS 18.1, doesn't work, just gets stuck on the lock screen

[@trueriver1950]

"Government and bad actors..." Surely you meant "Government and OTHER bad actors"

[@BTRSJ]

I have tried in most Xiaomi device with A12 Thankfully its not working

[@GingerWritings]

This is why I like Samsung secure folder. I can at least put another pin in the way of stuff. Not much, but I appreciate the feature.

[@macktheripper7454]

Same

[@cedricvillani8502]

These bugs are worth a lot more than 100K and grabbing finger prints from vids has been done for years, the ten-printers use prisms and Unix to grab a finger print that was as of 1999. SenseTime in Taiwan knows a bit about grabbing pictures and info from sources you may not think to check 🎉

[@lowwastehighmelanin]

the irony of me getting a Google Pixel ad on this 😂

[@heikosoeder]

The US backdoor are closed xD

[@ologhai8559]

when one backdoor close, another opens

[@chri-k]

a bacwindow has been created as a replacement

[@ologhai8559]

and if not that, then at least back chimney 🤣

[@lilyydotdev]

i remember doing that to a samsung device about 8 years ago, at that time i was too naive to realise it was a security vuln, very funny seeing this pop back up

[@lorenzcyber]

Nice video been loving them for a long time now!

[@LaurentiusTriarius]

There's probably a dozen Nigerian shop specializing in this exploit. (Glad your friend David got his bounty tho 👍)

[@Hichilisthxforspyingonme]

The first fucking time I’ve got an advertising it wasn’t for Google pixel but of course it was for fucking Google fiber

[@corel965]

Wow you are late toooo much cmon...it is patched already🤦🤦🤦

[@wombatdk]

There is no device that is secure, unless it is disconnected, powered off and hidden in a vault miles underground.

[@mrkiky]

What if someone digs a tunnel underground and then drills through the vault?

[@Jaob994]

After trying on my Nokia X20. Well.... I tried it 5 times and I only got it to work once I guess. I think it works a little bit different on all phones and I messed up once and did it by accident.

[@nulcow]

Yet another reason to not use Android

[@akingevo3930]

another reason not to use phones

[@trixer230]

The bug was left unpatched because law enforcement was actively using it.

[@NithinJune]

8:10 This could apply today to livestreamers and content creators

[@napent]

There is also another unpached bug that's allows to suppress lockscreen. I also reported it and get similar answer.

[@m4rt_]

... you could also just take of your glasses if you are near sighted (can't see things that are far away)

[@FAB1150]

TIL american SIM cards aren't protected by a PIN by default

[@MacGuffin1]

Dude using PUK code to bypass phone pin, been around since 2001

[@espero_dev]

i know a bug for all devices to bypass the pin and password get full access to everything

[@Gh0st_0723]

Instructions unclear, phone boots into IOS now. Need itunes account.

[@kingrutse3278]

This is pretty bad lol so the SIM cards have authority over everything lol

[@Hootie811]

I always giggle at the way you say depreciated , it sounds like it's head is getting chopped off! Is that how it's normally pronounced? We say it very different in Australia

[@uhZeny]

I use a dslr daily as my webcam, but I don’t wear glasses 😊

[@dislikebutton1718]

Lolll google said they already received that bug report. Lolllll you believe that? They say that so they don’t have to pay

[@TealTunic]

8:58 *AMONG US?!* (this is just a stupid joke. chill)

[@TJ_519]

using a pin locked sim to bypass lock screen and frp has been around for a little while now

[@atpray]

Might have to start using non reflective glasses or contact lens

[@akingevo3930]

use white and black camera and very cheap one for best privacy or just don't use camera

[@NeverTilt96]

a small price for what could have cost google way more in stock prices decreasing if he went and made the bug public :)

[@rakeshchowdhury202]

I read this on twitter, and well he should be thankful to that google employee for giving her hairpin 😂

[@snarevox]

who still has that thing with the puk on it from their sim card? i doubt i do... idek.

[@Aura_Mancer]

wait wait, why did you skip over a Google employee putting a bandaid on him??? That's hilarious xD

[@sebas0469]

Samsung phones aren't affected as for other OEMs not sure

[@adityachk2002]

Love the channel

[@ChrisDeAnna]

David=Randal from Recess✍️

[@creepychris420]

Backdoor 100%. Also why he was ignored

[@xpower7125]

The bug doesnt work on my tealme

[@mythakreep]

i got locked out of my phone today pls tell me a working way for the pin code

[@koghs]

Good thing my laptop's webcam is complete shit

[@infotruther]

I think the way to get around peeking is to where contact lenses?

[@rajeshnayak8492]

What about pattern lock, there is no way to put puk code in there.

[@foxtailedcritter]

To be fair though iPhone still has a way to bypass the lockscreen, bad IME and the find My iPhone. Least now they're both on the same field. Kinda iPhone vulnerability spans across several generations to this day.

[@shoalstone7831]

new market for low-res webcams

[@ElonTusk.]

xioami phones dont ask for sim pass, youll need to manually need put put a password on sim i think. never happened to me

[@xxxx-ey7rp]

Yes it’s a extra option you have to put on

[@pa3ckp7]

Wait you guys don't have to enter pin after every restart?

[@fliporflop7119]

Wait a min, so google payed someone 100k for submitting a bug that they could not replicate and payed 70k for the same bug that was explained better? How did they know the bug was real if they cannot replicate to verify? Anyone can make shit up.

[@chri-k]

i think there was a misunderstanding - first guy was likely not paid at all

[@BossBoss-hj8gw]

Is the raid forums 2.0 a scam or is it legit?

[@cameronmoore136]

Severe vulnerability found? Reluctance to fix it? Kinda sounds like it was a well-kept secret feature, rather than a bug...

[@JohnSmith-lc1ml]

70k is way to low of a reward

[@okgoodgame]

cant trust any tech thise days

[@btuard]

Google are terrible at patching their phones, I got my grandma a 6a because her old phone wasn't working anymore, only for the phone to stop making and receiving calls and they haven't fixed it since.

[@thisisalexsin]

If you guys think this is crazy, wait until you find about AT commands and android phones. I can remove google accounts, send ghost touch commands, remove lock screens, remove KNOX, etc with a few commands sent over the serial port in a few seconds. And yes this has been known about for awhile, people have been removing google accounts from phones with this sim password method for years

[@Life-Sky]

Didn't understand anything but you are probably missing out on 70k lol

[@thisisalexsin]

@@Life-Sky that heavily depends on what I needed to use it for

[@willstikken5619]

This pixel guy used Googles tactics on bug disclosures against them.

[@mintydevil7982]

8:59 NO WAY BRO SAID THAT

[@cid3384]

5:49 - isn't that FTX's Sam (SBF)?

[@FriedTendi]

If Google patches it like that does that mean that it will go out to all other Android systems too how far back does this bug go can you do it with old cell phones

[@JohnAlbertM]

"Give it a go on your own device and let me know down below if your phone is vulnerable." Nice try Black hat

[@MsMiDC]

The glasses reflection does have an easy fix though. Just dont put them on if you are that paranoid. Put in some lenses.

[@timothy-9995]

I got a google pixel ad on this video.