2

Let's say I am drug dealer and I want to protect my data on my phone.

I setup PIN for SIM and I enable encryption.

Now it's the tricky part, if I enable encryption with PIN, it's easy to brute-force it, right? I googled and I found something like USB Rubber Ducky which acts like keyboard and can be scripted.

Another option is to use encryption password, but my Android 7 Nougat is using same password for encryption and lock screen. So entering strong password every time I need to use a phone is too much.

But Pattern type of protection is convenient and it's not crackable with USB Rubber Ducky. Or can law enforcement mount some offline attack? Is this technically possible?

Are there any known procedures law enforcement use when they seize the phone? do they brute-force them? Do they ask google to change PIN? I think I'll delete my Google Account to prevent my country DEA from making it.

  • I could see patterns attacked with scripting, say if the USB device emulates a mouse, it could draw the patterns, although it may be difficult. – multithr3at3d Jan 21 '18 at 20:23
  • in the US, legally you have more protection if your key is biometric; it's part of your "person", so requires a warrant, whereas a password can be compelled with a writ or subpoena. unsure about elsewhere. – dandavis Jan 21 '18 at 23:28
1

It depends on the phone. More modern phones usually utilize a hardware security module to prevent against brute force attacks on the PIN. These hardware elements store the PIN and limit the rate at which PINs can be tried. Since Android L, Google experience devices (those that ship with the Play Store and GMail bundled) have required hardware-backed encryption. If you have such a device, it will take quite some time for your PIN to be brute forced (especially if you have a reasonably long PIN, e.g., 6+ digits).

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.