# How secure are iPhone/Android/Windows 8 “PIN”/Pattern Lock features?

Most modern (and tablet-oriented) operating systems now offer alternative ways of logging on other than a strong password. For example, iPhones offer a 4-digit PIN, Android devices offer this and a 'Pattern Lock', and Windows 8 devices offer the 'Picture Lock' in addition.

Obviously, these passwords are not terribly secure, and so (as with bank cards) some sort of lock-out applies. For iPhones, you get dramatically increasing delays, and for Windows, the PIN option is taken away leaving only the password entry option.

What is not clear to me is how these methods actually get enforced. What stops someone from attacking the system outside of the operating system? Or (at the very 'worst'), simply taking a copy of the storage and reloading the image onto the original device repeatedly? It's my understanding that even having Bitlocker on a Windows system wouldn't protect against the latter... or am I wrong and there is something clever with the TPM chip going on?

Also, as a semi-related question: Windows obviously encrypts credentials (such as those in Credential Manager) against the logon password. But since a PIN can bypass the logon password, does this mean the logon password is weakly encrypted somewhere (against the 4-digit PIN)?

Thanks,

Chris

Some mobile devices provide on device encryption to protect them, tied to the passcode/password that the user enters. When tied to a device wipe after a certain (small) number of incorrect attempts, they can provide an effective mechanism to protect the data held on the device in a "lost/stolen device" scenario.

To take iOS devices as an example, you can't easily bypass this kind of protection without the ability to get access to the device storage before the device boots, or by dis-assembling the device to remove it's storage and then crack the crytpto on the device.

Now using a 4-digit passcode or pattern lock reduces the protection provided considerably as it raises the possibility that an attacker will be able to guess the credential before the lockout occurs. for passcodes the fact is that most users do not choose random numbers but instead base it on dates (e.g. year of birth) which increases an attackers chances of getting the right code in the attempts available.

For pattern lock there has been research showing that the pattern is visible on the screen in the grease from fingerprints, unless the screen is well cleaned at all times.

So if you use a decent password and have the device wipe after a number of incorrect attempts, I'd say that the security is reasonable unless the attacker has an exploit for the platform which allows him to get access to the device storage before it's booted..

You are missing the point of the lockscreens of the various mobile operating systems.

They are not an effective deterrent for attackers who has stolen your phone and has an unlimited period of time to attack it. However, they are effective in deterring chance attackers who happens to walk by and only has a short period of access to your phone.

Kos demonstrated a P2P attack on Android at Derbycon last year that only takes seconds. PDF Warning: http://kyleosborn.com/android/AndroidPhySec.pdf Here is a video of the demonstration from Hak5 http://hak5.org/episodes/hak5-1205 (Kos starts at 6:55).

A lot of time with the pattern lock, there are ways you can just look at it and see what the pattern is from the grease smears. iOS often has bypasses to the lockscreen that require some complicated steps, but it's version dependent. If practiced, it could take you 30 seconds to unlock someone's phone and get whatever information you want out of it.

The security of a pattern lock is going to depend greatly on a) how it is implemented and b) how long and what path the user chooses. The interesting metric you are looking for to know how secure something is is a concept called entropy or randomness.

If entropy is maximized, then each choice should be unrelated to prior choices and the difficulty of guessing the pattern would be determined by the number of possible patterns. Assuming you have a 3 by 3 grid and can double back, you have 9 options for the first choice and then either 3, 5 or 8 choices available to you for each node after that. A relatively short pattern can still get up in the hundreds of thousands of possibilities, but it still isn't what a truly random password would give you.

That said, most people's passwords are pretty weak and as long as you have a limit on how many guesses can be done at a time that is fairly low, even a few hundred thousand is going to be a pretty good casual deterent though I wouldn't suggest guarding nuclear launch codes with it. The bigger problem is probably the ease of shoulder surfing a pattern.

What stops someone from attacking the system outside of the operating system? Or (at the very 'worst'), simply taking a copy of the storage and reloading the image onto the original device repeatedly?

On a PC, attacking outside the operating system is dead easy when you have physical access. All you need to do is boot from a CD or USB drive. If the BIOS has been configured not to allow that, you can take the hard disk out and plug in onto another machine.

Mobile phones and tablets doesn't allow booting from anything but the internal flash memory. When you power on the device, it boots into the operating system and doesn't respond to anything before the user has passed the login screen. (There are a few exceptions, such as Google's reference phones intended for development — and even for these the default bootloader lets you install an alternate boot image but wipes the device first.) So barring a bug in the bootloader or in the operating system, it is impossible to reach outside the operating system.

Bugs of course do happen. Apple's devices get jailbroken sooner or later, but these days it gets more and more difficult, with exploits getting very complex. Microsoft's Surface tablet hasn't been fully rooted yet. Android phones are rootable as a rule, but then Android wasn't particularly designed to prevent that (Android doesn't treat the user as hostile).

Physical access to the flash memory is of course possible, but the flash chip is soldered to the main board. Depending on the model, it may be that all you need to access it is some affordable electronic equipment (basically, the right kind of connector) and careful aligning of pins, or you may need to unsolder the flash chip from the main board. The latter case pretty much kills the resale value of the device, and even the former is beyond what your average thief is prepared to do.

Nonetheless, with physical access, a targeted attack can extract your data. As a rule of thumb, you should not store secrets on a mobile device that are worth more than about the resale value of the device. Your Facebook account isn't worth that much, but your company's financial data may be. And if your phone is seized in a police raid, this is routine for a forensics labs.

It's my understanding that even having Bitlocker on a Windows system wouldn't protect against the latter... or am I wrong and there is something clever with the TPM chip going on?

A TPM adds another layer of protection. It is a tamper-resistant chip: without some expensive equipment and the knowledge to use it, you cannot extract its internal memory (and you will probably render the chip unusable in the process). (There are also ARM-based platforms with a TPM that isn't a separate chip, but implemented as firmware in a system-on-chip. There also, physically extracting the keys involves dissolving part of the chip.)

With a (properly-used) TPM, the TPM chip contains a hash of the boot image. If you manage to reflash the device, the bootloader in ROM will complain that the boot image is bad and refuse to boot. The TPM may also be used to encrypt data on the device, again with a key that is stored in a tamper-resistant chip.

A 4-digit PIN, even if chosen at random (as opposed to 1234 or the owner's birthday), falls under 5000 attempts on average. There are a few more possible patterns, but they are very vulnerable to exposure through finger traces. This protects against a drive-by attacker who tries a couple of codes while the owner is looking elsewhere, but not against a patient and unhurried attacker. Credit cards store the number of failed attempts in their persistent memory: three strikes, and the card becomes unusable. Such extreme behavior is considered bad for most devices, especially a smartphone which may be used while in motion. So the protections tend to be more lenient, and in particular as far as I know rebooting the phone resets the counter on all major operating systems, so that an unhurried, equipped attacker can keep rebooting and attempting different PINs for hours until he finds the right one.