Android Lock-Screen Bug Could Let Thieves Into Millions Of Phones

According to experts, the Android Lockscreen for devices using Lollipop 5.0 or 5.1 can easily be bypassed using a simple method. In fact, if you chose a password instead of a PIN or pattern unlock to protect your Lollipop device, then anyone can get into your phone with a trivial hack that was just discovered and shared with the world. By doing this the attacker is able to crash the lock screen and gain access to the home screen. Whoops. From that point, you have full access to the phone until you lock it again.

Texas University researcher John Gordon first reported the bug to Google and received a $500 reward for his trouble. The attack won’t be successful if the user has secured the device with a pattern or pin configuration.

The flaw relies entirely upon a stock build of Android like you’d find on Nexus devices. When opening the options menu, put in the long string of characters into the password prompt. Google released a patch for its Android operating system last week, which contained a fix.

Gordon says he stumbled on the lock screen vulnerability while messing with his phone during a long East Texas road trip.

In July, for instance, mobile security company Zimperium announced the discovery of the Stagefright flaw, which allows attackers to exploit Android’s media library to deliver malicious code to a device. Google on September 9 released an over-the-air security update that patched this vulnerability and a number of others.

This vulnerability is scary because it doesn’t require any of the geeky smarts that hackers use to secretly break into your smartphone, and then install malware or listen in on your phone calls.

However, it can take months or even years for updates to hit the majority of Android phones.

Similarly, Google’s Nexus devices and Samsung’s smartphones will also benefit from monthly patches meant to guarantee their users’ safety.

The USA search giant described the glitch as a “moderate” severity issue. Before you know it, the OS crashes and reveals the home screen in response.

Turns out you don’t need to be a technical wizard to break an Android lock-screen password.