3

When someone is using my cell phone, I will sometimes give them the PIN number to unlock it so they don't have to ask me. Clearly, I only tell the code to people I trust not to mess up my phone. However, let's say an attacker overhears me telling someone I trust (or the person I trust later turns evil and plots to take over my phone). Either way, the attacker doesn't have physical access to the phone. What can he do? I don't think phones OS' are like laptop and desktop OS' in that the "user password" can also be used to gain remote access, but I'd like to make sure. My phone is a Windows Phone (8.1), but I'd appreciate answers for iOS and Android too.

0
2

Short Answer: For Windows phone, Android and iOS he would not be able to do anything. A PIN would only be useful to a attacker physical access or if he had remote access to your phone. If you are the average person and not high up in government you have nothing to worry about.

2
  • If he already had remote access, why would he want my PIN? – KnightOfNi Jan 19 '15 at 16:34
  • As an example: You may have a application on your phone that stores data and encrypts it on your phone. So you could not view that information without going through the correct application which that data belonged too. If the attacker had shell access he could install a VNC server application. He could then view your phone screen and use your PIN to gain further access to the phone. – Tim Jonas Jan 19 '15 at 16:40
2

The PIN code can only be used for unlocking the phone locally. For credentials storage, the PIN/pattern is internally translated into a password, using a phone-unique key.

Theres no way to remotely access a cell phone except for: Using Google Administrator - this uses your Google Account password to remotely access your phone, or if you install a app that allows remote access - and in this case, you configure the access password in the app itself.

And you are wrong about laptop/desktop OS too. In w7 and later, NO remote access is enabled per default. This means a password cannot be used to remotely access your laptop/desktop, unless you specifically enable remote access in the Control panel. There is a thing called "Remote assistance", but that is configured so you need to confirm (permit) the person helping you. During Remote assistance, the controlling indivual will not be allowed to input a password to bypass permit. Remote assistance is enabled per default and can be disabled in the Control panel.

However, some Linux OS:es do have a sshd running remote-accessible to allow for debugging. However, if you put your machine behind a router, any remote access will not be possible unless you specifically open the port.

Back to cell phones again: Normally, when connected to your mobile operator, your operator NATs the traffic behind their firewall (and you get a external shared IP - that is shared between multiple customers, and a non-public IP assigned to your phone), thus even if any remote access would be default open on your phone, nobody would be able to use it anyways.

Google Administrator works by having the phone "poll" the google website at regular times to check if the device should be locked, erased or tracked.

2
  • 1
    I don't do Mac much, but I'm pretty sure you can SSH into that, too. As for Windows, you can still do some stuff with the user password (I haven't tried the remote assistance bit myself, but what about uploading malware via shared folders, using Telnet, or simply annoying me by remotely shutting it down?). Still, thanks for your answer, I found it quite instructive! – KnightOfNi Jan 19 '15 at 16:31
  • Shutdown is only allowed with the administrator password if UAC is enabled. Also, Another thing to consider is that nothing is accessible if your´e behind a NAT, unless you specifically configure the NAT to forward traffic on certain ports. The NAT acts in other Words, as a natural firewall that blocks all incoming requests. Same with phones, since most 3G operators do NAT their customers behind a CGN. – sebastian nielsen Jan 19 '15 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.