1

The original question was about the minimum password (or PIN) length (or entropy) for the screen lock in Android. Seeing that nobody answered, and following Schroeder's advice, I'm going to edit it and just focus on the speed of the unlocking process.

So say you are an attacker and you find or stole an Android device, it's turned on, but it's locked by a password (or a PIN). What are the most common and feasible ways to unlock it or access its contents anyway, and how long would that take? Note that I said "feasible ways", because I'm talking about a real average-skilled attacker, not about government agencies or theoretical attacks that nobody in this community would actually be able to do.

Improve this question
6
  • 1
    This question is all over the place, but the core of the question appears to be "how quickly can Android phones be unlocked using automatic means?" Once that it answered, then all your other notions of length and entropy follow.
    – schroeder ♦
    Jul 17, 2018 at 13:17
  • how long should a rope be? it depends on the use-case. for me, 5 digits is the right balance between security and convenience.
    – dandavis
    Jul 17, 2018 at 21:23
  • keep in mind that bigger length doesn't mean bigger entropy. 5 random digit PIN is better than 8 Digit PIN made out of birthday date. And as humans ar bad at producing random numbers or use tricks like birthday for remembering passwords/PIN, the real entropy is often much lower than the theorical maximum entropy due to length
    – Kepotx
    Jul 18, 2018 at 7:25
  • @dandavis, but the point of this question is exactly how you would justify your 5 digits, why more would not be necessary and why less would be too insecure.
    – reed
    Jul 18, 2018 at 16:22
  • 3
    4 digits can be cracked 100% in 166 mins, at 6 guesses a min; under 3 hours. 5 digits takes over 24 hours, which is enough for me to discover the lost phone and remotely disable it, even if i'm asleep. -my $0.02
    – dandavis
    Jul 18, 2018 at 16:26

2 Answers 2

Reset to default
2

I can see two attack vectors.

  1. The device is booted and at the lock screen. Either a lock screen bypass or crashing the lock screen will work here. Exact methods will change depending upon which Android version you run. But the key point is that the Android lock screen is a screen overlay on Android 4, so crashing the lock screen will put you straight onto the home screen.

Android 5.x has CVE-2015-3860 vulnerability.

  1. This presumes the device does not have full-disk encryption enabled

If the device is not encrypted, boot into recovery mode and flash a custom ROM. You can change, disable or remove the stock lock screen. As you will have root access over the file system. Furthermore, you can access the file system directly without needing to worry about the password.

For encryption, Android 5.0 and upward full-disk encryption (/data is encrypted) is deployed and Android 7.0 and upward file-based encryption. Full-disk and file-based encryption. Full-disk encryption can be cracked by exploiting CVE-2016-2431. For those using unencrypted Android, the hash can be accessed via /data and brute forced.

Improve this answer
2
  • Reading through your second link, it looks like the attack method for cracking a password/pin hash relies on extracting a file from the /data partition. But this partition is encrypted with the password/pin you're trying to crack!
    – Ben
    Aug 2, 2018 at 16:34
  • I have edited the post to prevent confusion. I was unaware Android deployed a framework to prompt for the password. The updated post includes points from Android regarding encryption and should allow readers to deduce how the master key is stored. This should serve to preserve further deviating away from the original question.
    – safesploit
    Aug 2, 2018 at 17:08
2

What are the most common and feasible ways to unlock it or access its contents anyway ?

I tried this once successfully, however I'm not sure if it is the most common way. The general idea is to install a filemanager called "Aroma File Manager" using recovery mode and use it to locate and delete the file "gesture.key" or "password.key".

You don't have to be an expert and since the question is about the timing you just have to have an SDcard already on hand, the file to download is just 1400Kbytes in size and the good news is that the device doesn't have to be rooted.

and how long would that take?

it takes me way less than 10 mins

If you are interested in step-by-step process here are two links :

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .