1
  • Assume that it is an android 10+ and that it is encrypted.
  • Assume that it is protected by a 6-digit pseudo-random pin code.
  • Assume that the data can be erased remotely using google's "Find My Device" service.

If the thief shuts the phone down, they'll have to contend with the disk encryption (it will wipe itself after a certain number of incorrect tries)

If the thief doesn't shut down the phone, they'll have to bypass the lock screen before I am able to erase the data remotely.

If however, the thief simply places the phone in airplane mode (which doesn't require a pin to access), then they'll have unlimited time to bypass the lock screen.

  1. How likely are they to bypass the lock screen assuming little to no resources, fairly skilled, but hellbent on data extraction?
  2. Is there anything I can do proactively to not only make it harder for them to bypass the lock screen but also to prevent data-theft once/if they do.

The type of data I would be concerned about:

  • Email inbox.
  • Chat conversations (Skype; Whatsapp*; Slack).

I do have the option of removing said applications and data, but that would also make the phone largely useless to me.

Whatsapp Is especially tricky given that they'll also have access to the sim card, and I am unlikely to be able to have it blocked/replaced somehow. Can we please stop with this phone number based identity madness?

1

If the android device is on latest security patch, there's no way to bypass screen lock protection. Even if it's not fully updated, the thief has to search what known vulnerabilities can be exploited from locked screen for privilege escalation. He will also have to come up with an exploit. Many high severity and critical severity vulnerabilities that are fixed each month don't have publicly available exploits.

Screen unlock attempts timeout increases exponentially after every few incorrect attempts. If your unlock code is not in most predictable android lock patterns, it cannot be brute-forced. If the thief goes to recovery mode to factory reset the device, on first boot, device will ask for Google account credentials that were used to set up the device by the owner. This is called Factory Reset Protection.

By default, sensitive messages like OTP are displayed on lock screen. It can be disabled from settings. First, the thief will use your SIM to learn your phone number. Then he will reset Google account password using OTP showing up on your lock screen. After 72 hours, the new password can be used to unlock factory reset protection.

Your data is always safe but your accounts can be compromised with possession of SIM card alone. Use TOTP to protect your accounts and immediately request your network operator to block SIM. That will leave your device un-reusable for the thief.

5
  • In this case, the proactive things we can do that I can extrapolate from your answer would be: 1. Disable the lock screen display of texts/SMS. 2. Ensure that your google account password cannot be reset through your phone number/sim. Neither case applies to me, but, I'd imagine someone else reading this might appreciate it. A problem here is assuming that one can even have the sim card deactivated. I don't think this is possible if one is using a prepaid card.
    – gloomyfit
    Jan 12 at 11:10
  • The only way to prevent data theft, in that case, would be if one could somehow have the sim card itself encrypted with an access code.
    – gloomyfit
    Jan 12 at 11:11
  • TOTP-2FA prevents account hijacking using SIM card alone.
    – defalt
    Jan 12 at 12:53
  • Yes, but, that's not an option for say WhatsApp which is tied directly to your SIM, and a lot of services don't give you the option of using TOPT-2FA, they force you to rely on a phone number.
    – gloomyfit
    Jan 13 at 4:43
  • WhatsApp has 2 step verification. You can setup PIN from WhatsApp settings.
    – defalt
    Jan 13 at 4:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.