Security News > 2022 > November > Serendipitous discovery nets security researcher $70k bounty

In brief A security researcher whose Google Pixel battery died while sending a text is probably thankful for the interruption - powering it back up led to a discovery that netted him a $70,000 bounty from Google for a lock screen bypass bug.

Hungarian security researcher David Schütz said in a blog post that he made the discovery when powering up his Pixel 6 and forgetting his SIM's PIN code, requiring him to dig out the Personal Unlocking Key, or PUK, that would allow him to reset the PIN. After a reboot, his phone repeatedly hung on a "Pixel is starting" screen.

The problem stemmed from Android calling a.dismiss() function whenever the SIM PUK was reset.

Since the active security layer underneath was all that was left, Android dismissed it without realizing the mistake.

Later on, Google admitted that, even though his bug was a duplicate, it was only because of his report that the company took action and patched it in Android's November 5 security update.

"Based on our review, there was personal information exposed including: your name, social security number, compensation, gender, race, ethnicity, date of birth, and US Government security clearance eligibility and status as of March 29, 2021," the company said in a form letter [PDF] it sent to employees.

News URL

https://go.theregister.com/feed/www.theregister.com/2022/11/20/in_brief_security/