Hacker earned $70,000 for finding a way to bypass Google Pixel’s screen lock

A security researcher, David Schütz has received a $70,000 bug bounty after inadvertently discovering a Google Pixel lock-screen bypass hack that solved a high-severity security problem on all Pixel smartphones that could easily be exploited to unlock the devices.

Schütz discovered the vulnerability, which allowed an attacker to unlock any Google Pixel phone without knowing the passcode. Google fixed the problem, known as CVE-2022-20465, with an update in November, allowing Schütz to publish his findings.

Schütz discovered the problem by chance when he forgot the PIN code of his Pixel phone and had to enter the PUK code to gain access. He noticed anomalies in the lock screen that were presented to him after the successful completion of the process. After accepting his finger, the device crashed with a weird “Pixel is starting…” message, which Schütz addressed with a forced reboot.

The problem per Schütz, is rooted in the fact that lock screen protection is completely defeated when following a certain sequence of steps.

First, provide an incorrect fingerprint three times to disable biometric authentication on the locked device. Then, replace the SIM card of the device with a SIM controlled by the attacker that has a PIN code set up. Then, enter a false SIM pin three times to lock the SIM card. Then, the device asks the user to enter the SIM Personal Unlocking Key (PUK) code, a unique eight-digit number to unlock the SIM card. Then, enter a new PIN code for the SIM controlled by the attacker and the device will be automatically unlocked.

After following this sequence, before entering the PUK code and selecting a new PIN, he realized that he had completely bypassed the lock screen on the fully patched Pixel 6 and Pixel 5.

The sources for this piece include an article in TheHackerNews.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web