Bypassing Android’s lockscreen with a very long password

A bug has been found which allows anyone in possession of an Android smartphone running Lollipop to unlock the device by bypassing the lockscreen with a very long password.
The vulnerability, discovered by researchers at Texas University in Austin, potentially affects 21% of Android devices in use and requires the attacker to simply overload the lockscreen with text.
The bug affects only those users with smartphones running Google’s Android Lollipop using a password to protect their devices – Pin or pattern unlock are not affected.
The attacker need only enter enough text into the password field to overwhelm the lockscreen and cause it to crash, revealing the home-screen and giving full access to the device, whether encrypted or not.
John Gordon from Texas university said: “By manipulating a sufficiently large string in the password field when the camera app is active an attacker is able to destabilize the lockscreen, causing it to crash to the home screen.”
Google released a fix for the security hole on Wednesday for its line of Nexus devices, describing the bug as of “moderate” severity, but that it was not actively being exploited by attackers according to the company’s knowledge.

The researchers demonstrated the attack on a Google Nexus 4, and required the attacker to use the emergency call function to copy hundreds of characters to the clipboard. By using the camera, the settings pull down menu and prompting the password entry screen the long text string could be pasted into the password box causing it to crash.
The Guardian could not replicate the bug on a Google Nexus 6 or a Motorola Moto G – and entering that much text proved difficult and time consuming.
About 20% of the billion or so Android devices across the world run Google’s latest version called Lollipop, including new devices from Samsung, LG and Sony.
These devices will require a software update to fix the bug, but users will have to rely on the manufacturer of the smartphone and their mobile phone operator to roll out the update, rather than Google directly.
The attack requires physical access to the smartphone, and cannot be performed remotely. Users worried by the attack can change their lockscreen preferences to a pattern unlock or Pin code, which can be up to 16 characters long, instead of a password.
After the Stage-fright security vulnerability, Google, Samsung, LG and other Android smartphone manufacturers recently pledged to release monthly security updates for their latest devices, in an attempt to help prevent this kind of attack being used.