Samsung Galaxy S III bug lets anyone bypass password-protected lockscreen

[email protected] (Anupam Saxena)
March 8, 2013

Samsung_Galaxy_S_III

A user has discovered a security flaw in the Samsung Galaxy S III that allows anyone to bypass the lock screen of the phone by following a few simple steps.

Sean McMillan has posted a method to access the lock screen of the Galaxy S II on a mailing list. According to him the bug can be reproduced by following these steps:

1) On the code entry screen (of the lock screen) press Emergency Call

2) Then press Emergency Contacts

3) Press the Home button once

4) Just after pressing the Home button, press the power button quickly

5) If successful, pressing the power button again will bring you to the S3's home screen

McMillan mentions that it might take a few attempts to get the hack working and that sometimes the method works in one go while at others, it can take more than 20 attempts. He also adds that the method seems to work better when the mobile has auto rotation turned on. McMillan claims to have tested the method on three Galaxy S III devices.

We tried unlocking the screen of a Samsung Galaxy S III(GT-I9300 running Android 4.1.2) using the same method but weren't successful.

However, ZDNET says they were able to replicate the hack after a few attempts. The site states that the timing to replicate the issue is very small and that it is difficult to replicate it in the first attempt. But after bypassing the screen once, the bug stays on the device even when the phone's screen is turned back off and the phone stops asking the user for their PIN, password or pattern.

Just a few days back, another user, Terence Eden, had discovered a security flaw in the Samsung Galaxy Note II that allowed anyone to bypass the lock screen and take a look at the home screen app icons by following similar steps. But the hack didn't allow the hacker to use any of the apps.

Last month, a similar vulnerability was discovered in Apple iOS 6.1, allowing users to bypass the lock screen, following which Apple had acknowledged the issue and promised a fix.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
March 14,2020

New Delhi, Mar 14: Excise duty on petrol and diesel was on Saturday hiked by ₹3 per litre as the government looked to mop up gains arising from fall in international oil prices.

Special excise duty on petrol was hiked by ₹2 to ₹8 per litre incase of petrol and to Rs 4 incase of diesel, an official notification said.

Additionally, road cess on petrol was raised by ₹1 per litre each on petrol and diesel to ₹10.

The increase in excise duty would in normal course result in a hike in petrol and diesel prices but most of it would be adjusted against the fall in rates that would have necessitated because of slump in international oil prices.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 3,2020

Giving each and every app access to personal information stored on Android smartphones such as your contacts, call history, SMS and photos may put you in trouble as bad actors can easily use these access to spy on you, send spam messages and make calls anywhere at your expense or even sign you up for a premium "service", researchers from cybersecurity firm Kaspersky have warned.

But one can restrict access to such information as Android lets you configure app permissions. 

Giving an app any of these permissions generally means that from now on it can obtain information of this type and upload it to the Cloud without asking your explicit consent for whatever it intends to do with your data.

Therefore, security researchers recommend one should think twice before granting permissions to apps, especially if they are not needed for the app to work. 

For example, most games have no need to access your contacts or camera, messengers do not really need to know your location, and some trendy filter for the camera can probably survive without your call history, Kaspersky said. 

While decision to give permission is yours, the fewer access you hand out, the more intact your data will be.

Here's what you should know to protect your data.

SMS: An app with permission to send and receive SMS, MMS, and WAP (Wireless Application Protocol) push messages, as well as view messages in the smartphone memory will be able to read all of your SMS correspondence, including messages with one-time codes for online banking and confirming transactions.

Using this permission, the app can also send spam messages in your name (and at your expense) to all your friends. Or sign you up for a premium "service." You can see and conrol which apps have these rights by going to the settings of your phone.

Calendar: With permission to view, delete, modify, and add events in the calendar, prying eyes can find out what you have done and what you are doing today and in the future. Spyware loves this permission.

Camera: Permission to access the camera is necessary for the app to take photos and record video. But apps with this permission can take a photo or record a video at any moment and without warning. Attackers armed with embarrassing images and other dirt on you can make life a misery, according to Kaspersky.

Contacts: With permission to read, change, and add contacts in your address book, and access the list of accounts registered in the smartphone, an app can send your entire address book to its server. Even legitimate services have been found to abuse this permission, never mind scammers and spammers, for whom it is a windfall.

This permission also grants access to the list of app accounts on the device, including Google, Facebook, and many other services.

Phone: Giving access to your phone means permission to view and modify call history, obtain your phone number, cellular network data, and the status of outgoing calls, add voicemail, access IP telephony services, view numbers being called with the ability to end the call or redirect it to another number and call any number.

This permission basically lets the app do anything it likes with voice communication. It can find out who you called and when or prevent you from making calls (to a particular number or in general) by constantly terminating calls. 

It can eavesdrop on your conversations or, of course, make calls anywhere at your expense, including to pay-through-the-nose numbers, Kaspersky warned.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
March 16,2020

While Google is still working on a coronavirus screening and tracking website, Microsoft Bing team has already launched a web portal for tracking COVID-19 infections worldwide.

The website, accessible at bing.com/covid, provides up-to-date infection statistics for each country.

The COVID-19 Tracker currently lists 168,835 as total confirmed cases, 84,558 active cases, 77,761 recovered cases and 6,516 deaths.

There are at least 3,244 confirmed cases of novel coronavirus in the US and at least 61 deaths.

"Lots of Bing folks worked (from home) this past week to create a mapping and authoritative news resource for COVID19 info," Michael Schechter, General Manager for Bing Growth and Distribution at Microsoft, was quoted as saying in a ZDNet report on Sunday.

An interactive map allows site visitors to click on the country to see the specific number of cases and related articles from a variety of publishers.

Data is being aggregated from sources like the World Health Organization (WHO), the US Centers for Disease Control and Prevention (CDC), and the European Centre for Disease Prevention and Control (ECDC).

Microsoft announced the website two days after US President Donald Trump said Google has begun working on COVID-19-related portal for US citizens.

Google's website is being built by Verily, a subsidiary of Alphabet focused on healthcare services.

"More than 1,700 engineers are currently working on the site", Trump said during a press briefing last week.

The tool will triage people who are concerned about their COVID-19 risk into testing sites based on guidance from public health officials and test availability.

Initially, there was some confusion on Google's coronavirus portal but the company later announced that it is "partnering with the US Government in developing a nationwide website that includes information about COVID-19 symptoms, risk, and testing information."

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.