The last two paragraphs can be seen as a brief Tl;Dr.
As you have probably already read a critical vulnerability in Android has been found by a researcher accidentally that allows to bypass the Android lock screen and to unlock the phone without the password on Pixel devices and potentially also many other devices. Here is his original post: https://bugs.xdavidhu.me/google/2022/11/10/accidental-70k-google-pixel-lock-screen-bypass/
Tl;Dr: When the phone is locked an attacker can swap the SIM card to their own while on the password entry screen. The device will then show the unlock SIM screen on top of the lockscreen password entry screen. Now the attacker can intentionally enter an incorrect PIN to their SIM card three times causing the SIM card to get locked and requiring the PUK code. When the attacker enters their PUK to unlock the SIM card again and then sets any new SIM pin the phone will unlock without requiring the lockscreen password. All the attacker needs is access to the locked phone, that just needs to have been unlocked once since the last boot and any SIM card they know the PUK of.
The vulnerability is in AOSP and could therefore also affect other non Pixel devices depending on whether the OS uses the AOSP or a customized variant of the lock screen and PIN screen. The vulnerability has been fixed in the November Android security update. So if you are on a Pixel make sure to update your phone quickly and check that you have the November security patch. I read somewhere that the vulnerability got introduced with Android 12, but I cannot verify this. All Android devices without the November 2022 security patch are potentially vulnerable until confirmed otherwise. Even if they are not vulnerable the unlock system before that security patch had significant security issues that made this vulnerability possible and could lead to other similar vulnerabilities being found.
I can personally confirm that the exploit is working on GraphneOS prior to the November security patch.
What to do know
The most important thing is of course to update the OS to get the patch. But there is one huge catch: many manufacturers take very long to incorporate the Android security updates into their custom Android variants and to publish security updates. Even worse many Android devices are no longer supported by the manufacturer and do not get security updates anymore at all. This means many potentially vulnerable Android devices are unpatched and there is no patch available. If your device is still supported you should pay especial close attention to updates in the next time and install them timely. Devices no longer officially supported might have custom ROMs with newer AOSP security updates available (e.g. GrapheneOS has the November security patch for the Pixel 4 and Pixel 4 XL). However custom ROMs can come with their own issues and are not a solution for the huge number of average users.
Mitigations and general advice
Since some time Android encrypts user data with filesystem encryption. When you boot your phone the data is encrypted and not accessible until your enter the password so it can get decrypted. A lockscreen bypass cannot bypass encryption. There is a huge difference whether your device is freshly booted and all user data is at rest and encrypted or whether it is just locked. Once you enter the password Android stores the encryption keys in memory and loads data to memory. Now your user data is accessible to Android and only the lockscreen protects it against someone with physical access. A lockscreen is generally much less secure than encryption. There is significantly more attack surface once you unlock your device after boot as this vulnerability shows. Also biometric authentication is only available after the first unlock which is more vulnerable to different attacks like forced unlocking or tampering and faked biometrics.
What this means is that when you shutdown your device or reboot it, it is invulnerable to this lockscreen bypass as it is protected by something much stronger: encryption. Only once you enter the password again it becomes vulnerable.
The following is good advice in general but especially important now for people with unpatched devices:
(Tl;Dr:)
If you get into a situation where your device is more susceptible to physical access by others such as border control, a police control, anything like that or you let your device unsupervised somewhere or store it somewhere without using it for some time, turn off or reboot your device beforehand. This will make sure all user data is encrypted at rest and significantly reduces attack surface for a physical attacker.
Of course every encryption and every lock screen is just as secure as the password. This is also a good example of why security update support is important. When buying a device, pay attention to the time frame for guaranteed security updates. Also be careful about how long different Android manufacturers take to publish security updates. Generally Android variants closer to AOSP like Pixel stock Android or Graphene OS get security updates quickly while heavily modified manufacturer variants like Samsung’s One UI, Huawei’s EMUI or Xiaomi’s MIUI take much longer.
