Android lockscreen can be bypassed by overloading with massive password

A bug has ben found which allows anyone in possession of an Android smartphone running Lollipop to unlock the device by bypassing the lockscreen with a very long password.

The vulnerability, discovered by researchers at Texas University in Austin, potentially affects 21% of Android devices in use and requires the attacker to simply overload the lockscreen with text.

The bug affects only those users with smartphones running Googles Android Lollipop using a password to protect their devices – Pin or pattern unlock are not affected.

The attacker need only enter enough text into the password field to overwhelm the lockscreen and cause it to crash, revealing the homescreen and giving full access to the device, whether encrypted or not.

John Gordon from Texas university said: By manipulating a sufficiently large string in the password field when the camera app is active an attacker is able to destabilise the lockscreen, causing it to crash to the home screen.

Google released a fix for the security hole on Wednesday for its line of Nexus devices, describing the bug as of moderate severity, but that it was not actively being exploited by attackers according to the companys knowledge.

The researchers demonstrated the attack on a Google Nexus 4, and required the attacker to use the emergency call function to copy hundreds of characters to the clipboard. By using the camera, the settings pull down menu and prompting the password entry screen the long text string could be pasted into the password box causing it to crash.

The Guardian could not replicate the bug on a Google Nexus 6 or a Motorola Moto G – and entering that much text proved difficult and time consuming.

About 20% of the billion or so Android devices across the world run Googles latest version called Lollipop, including new devices from Samsung, LG and Sony.

These devices will require a software update to fix the bug, but users will have to rely on the manufacturer of the smartphone and their mobile phone operator to roll out the update, rather than Google directly.

The attack requires physical access to the smartphone, and cannot be performed remotely. Users worried by the attack can change their lockscreen preferences to a pattern unlock or Pin code, which can be up to 16 characters long, instead of a password.

After the Stagefright security vulnerability, Google, Samsung, LG and other Android smartphone manufacturers recently pledged to release monthly security updates for their latest devices, in an attempt to help prevent this kind of attack being used.