Under what circumstances is it possible to bypass screen lock and get data on Android?

Question

I would like to know how to get data on an Android phone with soft methods - that is, no physical methods, such as looking at the imprints on the screen, disassembling the device, etc. Let's assume that Android is upgraded to the latest version and there are no unknown bugs that would cause the insecurity of the phone.

I would like to know if my phone would still be safe under these circumstances, respectively, and what is the minimum requirement for theoretical full security:

1. The device has USB debugging enabled, but all trusted ADB hosts are safe and not touched by malicious people. (Looks like the ADB host has to be trusted before ADB can connect to it, and it is possible only after unlocking the screen, so it should be safe?)
2. The device has been rooted (such as a development image) and a number of common, famous apps (such as Root Explorer) that require root has been installed.
3. The disk is fully encrypted. In this case the hacker is allowed to disassemble the phone to get the storage module (and the storage module only).
4. Uses an 8-digit number password that is not so strong - not crack-able by trying by hand, but crack-able with a rainbow-table attack.

And are there any other thing that seems safe but not actually?

Answer 1

Android is updated to the latest version and there are no unknown bugs that would cause the insecurity of the phone...

Then yes, you are safe in that theoretical situation.

Unfortunately that situation will never be true - there are always going to be unknown bugs.

---

Additionally, one of the apps could be updated with a malicious update.

Answer 2

If you assume no unknown bugs and no physical access, then Android doesn't allow bypassing the screen lock. Of course “no unknown bug” is unlikely to last longer than until the next Black Hat conference.

However physical access isn't just about “invasive” things like unsoldering the memory or even reading fingerprints from finger smudges. Some phones have a recovery mode that can be triggered by holding certain buttons when starting, and the recovery mode allows reinstalling the operating system. They're usually configured to wipe all data before wiping the operating system, but you should check whether that's actually the case — some manufacturers or authors of alternate ROMs get this wrong.

If the attacker has a dump of the encrypted filesystem, how easy it is to break depends on how the encryption key is derived. If the encryption key is solely derived from the user's 4-digit PIN, then no matter how well-done the derivation is, it's easy to enumerate all possibilities. If the encryption key is derived from secret material that isn't on the flash partition, then (once again, assuming no unknown bugs) the encrypted filesystem is unbreakable. There are Android devices where full-disk encryption uses a key which is stored in the CPU chip, but manufacturers often don't document this, and it can vary depending on the exact device configuration (e.g. commercial model XYZ-42 sold in different countries might use a different CPU and so one might have safe encryption and others not).