CyanogenMod logged swipe gestures used to unlock Android devices

[gregmcc]

http://arstechnica.com/security/201...wipe-gestures-used-to-unlock-android-devices/

CyanogenMod, an alternative open-source firmware distribution for Android smartphones and tablets, has been recording the swipe gestures used to unlock the devices, a developer involved in the open-source project said. The issue has been corrected in an update.

 

[Park@82]

causing the unlock pattern to be recorded in a log file stored on the device.

No harm done then? /I'm not using unlock patterns anyway to much of a pain IMO.

Come to think of it, this could just be a simple backdoor that a developer left in to help users that forgot the pattern. I know of at least one person that had to hard reset a device because he forgot the pattern.

 

[rodga]

would be cool for them to release the popular ones

 

[xumwun]

would be cool for them to release the popular ones

They can't.
It's logged to a file on the device, not to a server.

 

[rodga]

i see

 

[Bona Botse]

No harm done then? /I'm not using unlock patterns anyway to much of a pain IMO.

Come to think of it, this could just be a simple backdoor that a developer left in to help users that forgot the pattern. I know of at least one person that had to hard reset a device because he forgot the pattern.

Does it not prompt you to log in to your gmail account if you forget the pattern?

 

[Park@82]

Does it not prompt you to log in to your gmail account if you forget the pattern?

Not that I am aware of, maybe in post ICS versions?

 

[Bona Botse]

Not that I am aware of, maybe in post ICS versions?

I just confirmed it on my S2 running CM9. If you get the pattern wrong a few times it blocks you from trying for 30 seconds, and gives the option to unlock with your gmail credentials.

 

[Park@82]

I just confirmed it on my S2 running CM9. If you get the pattern wrong a few times it blocks you from trying for 30 seconds, and gives the option to unlock with your gmail credentials.

Still could be problematic: Exhibit A - Any tablet with WiFi+3G turned off. How would it authenticate to the google servers?

 

[mercurial]

It would be useful to know why they decided to log that info. They should probably tell everyone why.

 

[Nameite]

Still could be problematic: Exhibit A - Any tablet with WiFi+3G turned off. How would it authenticate to the google servers?

Maybe it compares it to offline records? I remember my CM7 had an option to type a password if you get it wrong too many times

 

[Park@82]

Maybe it compares it to offline records? I remember my CM7 had an option to type a password if you get it wrong too many times

Offline record of your google account? That would be far worse... Tested briefly on my tablet yesterday there seems to be no way to get in if you have no internet and you have forgotten the pattern. /I'm not using CM...