Security hole in Android - Xoom General

For more info follow this link. Though the alert is focused on phones, it also affects 3.1.
http://forum.xda-developers.com/showthread.php?t=1084086

How about these security apples?
I use a pattern to secure my Motorola Xoom (Verizon 3G/WiFi). On three occasions now, the device has become un-responsive even to the point that I was unable to reboot the device or power it down. On each occasion, when the device finally becomes responsive I am presented with a password screen to unlock the device and NOT the pattern. Seeing as I have never set an actual password for the device (only the pattern) I could only determine that perhaps the device wanted my Google/Gmail password to unlock.... but no luck. After many, many (40+) failed attempts, the device does a factory restore. Furthermore the device would not fully power down, it was only able to reboot via the vol and pwr keys.
This happened twice and on the third occasion I brought it to Verizon. The rep was at a loss and didn't know what the issue might be. His first thought was to use my Google/Gmail password to unlock it. I indulged his theory just to show him it would not work. He then said he would need to restore the device, to which I asked him how this could be done when the device would not fully power down? He sort of dis-regarded my question and proceeded to read his screen for what I assume to be the instructions for performing a manual reset. Once he realized I was on to something, he stated that there was nothing they could do in-store and that the device would need to be shipped back for repair... So I went home to await FedEx and my return package....
This is where the possible security hole comes into play... Before FedEx could arrive, the battery drained down and the low battery warning pop-up was displayed (yes, the device was still locked with the mystery password). I was able to click the settings button on the pop-up and VIOLA! I was back into using the device, thus bypassing the password which had it locked... I then proceeded to confirm full functionality of the device and used it for about a week with no further issues. I still sent the device back for repair, but wondered if anyone else has seen this occur and/or has any further information on this possible security hole.
Android: 3.1
Baseband: N_02.0F.00R
Kernel: 2.6.36.3-gcbee64 / [email protected] #1
Build: HMj37

edengberg said:
For more info follow this link. Though the alert is focused on phones, it also affects 3.1.
http://forum.xda-developers.com/showthread.php?t=1084086
Click to expand...
Click to collapse
The article seems to say that Android 3.X devices shouldn't be affected. Where did you get that information?

Related

***Need help ** *Device was locked - any idea how to open

My device has been working perfectly till suddenly & without any early notice the device has been locked with some kind of locking.
After reset the device goes into the locked status showed in the pictures, no option to do hard reset,
Tried all options, seems like one of the keys is defective and that’s why can’t perform hard reset.
The device is locked and the 90 minutes limit don’t go down, you can’t do anything.
However if there is a incoming call, you see it on the screen and you can answer the call.
Does anyone familiar with this lock screen ? how do i pass it & relase the device? please advise & help me ....
This is the password protection built into all versions of windows CE. (accesed form control panel/personal/security (or something like that, may vary with OS versions). It has options to lock the device after switching it off (going to sleep mode is considered switching off too), or after the device is not used for a given period of time. The whole point of this protection is to prevent unauthorized access to the device, so i think that without the password you're screwed
Did someone play with your phone before that happened? Maybe it was a "joke" by one of your friends? If you never set the password, anyone can enter the password settings applet and enable it. That's why it's always a good idea to set the password, even if you don't plan to use it -it is also required to enter security settings...
So, if you really want to HR, first of all make sure that one of the buttons is really defective - I just checked and you can't turn off the device by holding the power button when it's loched - this might be your problem. So try holding the comm manager and voice command buttons and press reset button on the side (keep the side buttons pressed until you get the "reset to factory defaults" question)
.
If that doesn't work, try checking if the device connects to activesync when it's locked. It shouldn't happen, since it would be a possible security hole, but knowing microsoft...
If it does you might try to flash its ROM (of course you would lose all your data).
And if it does not and one of the buttons really is defective you might have to disassemble the device in order to do a HR (by shorting the switches' contacts with some metal object), but i wouldn't do this if you don't have some experience with electronics, since you might damage the phone if it's not handled properly with case removed. It might be easier to go to a GSM repair shop and have the switch replaced.
itzik-g said:
My device has been working perfectly till suddenly & without any early notice the device has been locked with some kind of locking.
After reset the device goes into the locked status showed in the pictures, no option to do hard reset,
Tried all options, seems like one of the keys is defective and that’s why can’t perform hard reset.
The device is locked and the 90 minutes limit don’t go down, you can’t do anything.
However if there is a incoming call, you see it on the screen and you can answer the call.
Does anyone familiar with this lock screen ? how do i pass it & relase the device? please advise & help me ....
Click to expand...
Click to collapse
Forget all that password bs. Lock your device with this rogram. Unlock by pressing both soft keys at the same time.

Password locking issue...

This is weird. My company requires that I have a password on my device. So be it. I want to say that when I upgraded to WM6.1 this issue started, but it might have been there before. Not sure. Anyway, here is the scenario:
1) Phone coming back from a soft-reset/battery removal/etc. Doesn't
matter, as it always does this.
2) The outline of the Password screen pops up, I press top left of outlined
area.
3) Enter password the second that the numbers show up and press unlock.
4) If I don't do it fast enough, the device locks up - HARD!
5) To come back from this, I have to do a soft-reset and perform 2 & 3
fast. If I do, the device works fine. In fact, subsequent password
entries will work fine. Only the very first one after a reboot.
Any ideas on this? I did a little searching and didn't find anything specific to this issue. But then again, my searching sometimes isn't perfect! :-D
Thanks in advance! Cheers...
I've seen something like this, though not as bad.
Try turning off absolutely everything on the Today screen to see if that helps.
When I saw it, I think a program was firing up in the background while the password screen was displayed.
WannaBeSedated said:
This is weird. My company requires that I have a password on my device. So be it. I want to say that when I upgraded to WM6.1 this issue started, but it might have been there before. Not sure. Anyway, here is the scenario:
1) Phone coming back from a soft-reset/battery removal/etc. Doesn't
matter, as it always does this.
2) The outline of the Password screen pops up, I press top left of outlined
area.
3) Enter password the second that the numbers show up and press unlock.
4) If I don't do it fast enough, the device locks up - HARD!
5) To come back from this, I have to do a soft-reset and perform 2 & 3
fast. If I do, the device works fine. In fact, subsequent password
entries will work fine. Only the very first one after a reboot.
Any ideas on this? I did a little searching and didn't find anything specific to this issue. But then again, my searching sometimes isn't perfect! :-D
Thanks in advance! Cheers...
Click to expand...
Click to collapse
Do you possibly have some other type of startup program running in the background? I had something similar (can't recall now exactly what it was) when I was using a Wizard a couple of years ago. It was like the lock interface kept losing the "focus" after a few seconds. Ultimately I hard reset and started from scratch, but the issue never resurfaced.
In the end I chose to stop the policy enforcement from my company's Exchange server altogether. Not necessarily recommending you do the same, as it's surely frowned upon by all pointy haired bosses in IT. But in the event you'd like to experience the Dark Side of the Force... here ya go.

Hard reset on HTC Ozone?

Hello to all,
I have the HTC Ozone from verizon... Recently I flashed the custom Windows Mobile 6.5 Rom onto the device and attempted to install my screen reader without much success. (yes... I have no vision.)
Now, the device boots up, but is frozen at the windows mobile splash screen. I can't seem to find a way to reset the device without it loading Windows mobile completely. When I plug it into my laptop, USB is not recognized.
Does anyone know a key combination I could use to reset the Ozone (at boot)? I used to have a Q but Enter with the end key does not work anymore - and the user manuals only talk of using the "clear storage" option in system tools.
Any help is appreciated.
With all due respect-
Tomi
did u hardSPL ur device?
u gotta start there..sounds like you didnt tho. Theres another member whos in ur shoes at the moment, who himself didnt read the instructions.
yeah... I knew of hard spl, and it ran to 100%. But I guess it didn't install. in the end I had to go to verizon and they replaced the phone - however I will not be flashing another cooked rom until we get a signed stock ozone vzw rom.. Or generic.
I was told on another thread here that holding down the volume down key + send +end will put the device in reset mode, and that's true. However even that didn't help, my rom was prob gone.
-Tomi
You can do a Clear Storage from bootloader by turning off the device. While holding volume DOWN key and SEND key, power on the device. Follow the prompts.
If that doesn't do it, it's bricked.
hmm. there used to be a forum topic filled with stock roms (they still required hard spl) but I can't find it... Is it still up? the files were on mediafire.
Bricked by password utility
Maybe this deserves it's own thread but I may have found a way to brick an HTC Ozone by setting and removing the password.
I got the phone 4 days ago and after messing around with the installed applications and finding some of them lacking I looked at alternatives. First I installed a version of Keypass for WinMo6.1 smartphones (the beta version since the older version doesn't support smart phones) and the basic functionality seems to work fine. Then I then I tried to install Opera Mini but there appears to be no JVM on this phone so the install file was not recognized by Windows. Then I tried UCWEB and ended up uninstalling it after a few frustrating moments trying to get it to open any page other than the UCWEB home page. So I removed UCWEB and installed Skyfire. Unfortunately I didn't install the latest version and foolishly clicked on the update button when Skyfire started up. The update feature appears to be broken and it leaves you with a Skyfire that won't run and won't uninstall. After a few hours searching for solutions and trying various options I gave up and did a hard reset from the OS. This appeared to work fine and since it was late I went to bed. I should mention that all of the 3rd party apps were installed to a 2GB micro SD card and that I took the card and SIM out when I did the hard reset.
The next day when I powered up the phone I got a screen with colored bars, which I remember reading was a boot loader screen. The phone had appeared to reset properly the night before but I didn't do more than scroll through the home screen before powering it off with the end button. From the boot loader screen I had to pull the battery to shut down but when I powered it up again things seemed fine. I installed the Google maps application (highly recommended), downloaded and installed latest version of Skyfire and installed the Google search application and everything seemed to be fine. I decided that I should try out the password lock feature and set an eight character alphanumeric password with two special characters and two capital letters. I used it for the rest of the day to surf the web, send some texts and plot driving paths with Google maps. I found the password lock a bit annoying but never had a problem unlocking after the device went into standby or after I shut it down. That night I downloaded a couple of largish (150 MB or so) MP3 audiobooks from netlibrary.com but couldn't play them with the included Windows Media Player. Despite having MP3 extensions WMP wouldn't open them and clicking WMP from the start menu appeared to do nothing. Then I tried to re install Keypass and got an insufficient memory message. I deleted some photos and a short video I'd taken with the phone software and did a soft reset (power cycle) but no joy. Unable to play my MP3 files or install keypass and getting the occasional memory warning I decided a hard reset was in order but waited until the next day.
The next morning, after the phone had charged all night, I decided to remove the annoying password lock and then shut down and restarted the phone in order to verify that the problems I'd had the previous day still existed. I navigated to the Security settings and unchecked the box about password protection then powered off the phone. When it came on again it asked for a password. Annoyed, I hit the soft key under the "UNLOCK" notification and keyed in the password I thought I had just disabled and got a screen that said "Alert The password you typed is incorrect." I'd seen this a few times before since my thumbs are not optimally sized for the keyboard so I entered the password a few more times taking care to get it exactly right. It seems that my password has been removed but the requirement to enter a password has not. I tried a blank password but it won't take one it just reiterates the UNLOCK prompt. I have the password written down, it's also a variation of one I've used a lot in the past, and I'd used it successfully dozens of times the previous day so the likelihood of my having "forgotten" it is pretty low. I called Verizon and after they suggested entering a blank password I tried again and reported the failure. Their only suggestion was a visit to a Verizon store to "re flash" the phone which I assume means reload the ROM image.
I found the hard reset suggestion below and tried it. I assume the DOWN key is the bottom D-Pad key and the SEND key is the green bracket key with the microphone icon to the left of the D-Pad. I tried holding the DOWN and SEND keys and hitting the power key until the HTC logo came up and the phone buzzed briefly and I tried holding the keys down until the phone booted to the UNLOCK screen but nothing changed the boot sequence. So I guess my phone is bricked and I'm on my way to the Verizon store shortly to see what they can do. I also noticed that the phone occasionally emits beeps for no apparent reason at random times while entering the unlock password. Also, there is an Alert message behind the UNLOCK icon that says "Alert There is not enough free space to download message. Please free up some space". I wonder if in my efforts to download a few hundred megabytes of MP3 files (audio books) I managed to clog the memory and that I can't unlock the phone because there is a memory logjam of some sort. While downloading the MP3 files I did have to kill Internet Explorer from the task manager a couple of times as it seemed like the download had hung and I couldn't find the downloaded file anywhere on the storage card or in system memory. I haven't installed anything to system memory and with a 2GB card I don't think I've come anywhere close to filling it up. I had about 500 MB in files on the SD card at one point but I deleted the extra install files and some other stuff I'd downloaded. When I put the SD card in a USB reader hooked to the PC I see 378 MB of files with 1.46 GB of free space.
I'm pretty convinced that the OS is buggy (it is Windows after all) and that I need to avoid the password utility and downloading large files until I figure out what the safe combinations of activities are.
Assuming they can resurrect the phone or give me a new one I'll try to set and clear my password at the store and see if that reproduces the problem.
Meanwhile I'd be interested in any sort of hardware based hard reset procedure that works with the Ozone since holding the green SEND button and Down D-Pad key while powering up does not work in this situation. Perhaps the fact that I can't power down and I have to remove the battery to shut the thing off is a problem but I would expect a hardware reset to work no matter what the state of the software is, even if the memory system were full of garbage. I guess designers have gotten away from dedicated reset buttons but software based hard reset mechanisms seem doomed to failure of the sort I am experiencing.
I'll report back my experience at the Verizon store when I get back. I suspect they won't be able to do much other than give me a new phone since I can't get the Active Sync software to even talk to the phone in this state. Maybe they have a lower level software tool to unbrick me; we'll see.
Max L.
ookba said:
You can do a Clear Storage from bootloader by turning off the device. While holding volume DOWN key and SEND key, power on the device. Follow the prompts.
If that doesn't do it, it's bricked.
Click to expand...
Click to collapse
Wow.
Sorry, I got bored halfway through your discertation. However, I did note a mistake that you made.
Hard Reset: A guide for long-winded users.
Step 1: Power down the phone. If your phone is already powered down, you may skip this step. Note: Removing the battery, while technically powering down the phone, is not the correct method to make the following steps work.
Step 2: With your left hand, press and hold the VOLUME DOWN button that is located on the side of the phone. Continue pressing the VOLUME DOWN button and press the SEND button. With both the VOLUME DOWN and SEND button pressed, use your right hand to press the POWER button.
Step 3: A gray screen will appear asking you three options. Pressing the VOLUME UP button on the side of the phone will be the correct option to hard-reset your phone to ROM default.
Step 4: Press SEND to verify choice.
Step 5: Cuss loudly because you forgot to back up contacts, calendar, and email. (Optional: Crying like a little girl always makes things better.)
There you have it, a true hard-reset.
NOTE: The D-PAD is not Volume Control. Utilization of the D-Pad in this operation will result is user failure.
HTC Hard Reset from password lockout solved
I had managed to lock myself out of my phone by setting a password and then unchecking the password required box under the security settings and power cycling the phone when I got low memory alerts (see previous post).
I was able to hard reset my phone by removing then replacing the battery to power the phone down then holding the VOLUME DOWN button and SEND keys at the same time while pressing the power button to bring up a menu that allowed a hard reset. You can follow the menu prompts from there. If you power the phone down normally this still works but if you are locked out with a password you can't power down normally.
My lessons learned are:
1. To hard reset a password locked HTC Ozone hold VOLUME DOWN and SEND while powering up.
2. If you get a clueless Verizon rep call back later as they do have some helpful people in tech support
3. I've yet to find anyone helpful at any of the nearby stores so that avenue was a waste of time and gas.
I've written up a more detailed account of my saga that has some other useful phone numbers and resources should anyone have special problems with their HTC Ozone phones.
When I first had the password lockout I called Verizon and after after some basic efforts to trouble shoot they said go to the Verizon store for a re flash. At the Verizon store (Waldorf, MD) they said, after 15 minutes or so of waiting, that they couldn't do anything for me. Back home I called Verizon again (866-406-5154) and got someone who was much more helpful but still unable to fix things. It seems these phones are new enough that the Verizon techs don't know the tricks yet. They did provide a number (800-229-1235) for Personal Communications (http://www.pcdphones.com/formerly UT Star Com) but that number is only staffed from 8AM to 5:30PM M-F (not sure which time zone). However the voice message mentioned a hotline number (866-806-9990) which I called. This referred me back to the 800-229-1235 number for "unlock code" issues but I stayed on the line anyway and got someone who tried to help me out. At some point they mentioned holding the DOWN VOLUME button and SEND button while powering up the phone. They thought this would clear the memory but not the password setting. I tried it anyway and it worked.
While pressing both the Volume Down button and SEND button you need to hold the Power/END button in for a second or so until you see the following menu screen (the misspelled "resotre" is exactly how the menu appears):
Wiping user data/settings &
any user installed applications...
1. Press VolUp to restore
manufacturer default.
2. Press VolDown to resotre
custom configuration.
3. Press other keys to
cancel.​
At this point pressing the VolUp button gets you a screen that says:
Are you sure
you want to wipe your phone?
Press Send Key to confirm,
and any other key to cancel.​
Pressing the Send Key results in:
Restoring . . .
Wait for completed​where the second line is in red
After less than a minute you should see:
Restore completed
Press Volume Down to restart​
Pressing Volume Down restarts the phone.
First you see the HTC boot screen for about 40 seconds followed by the Verizon splash animation. Then the green Windows Mobile Version 6.1 boot screen comes up about for 90 seconds while the back light flashes on and off a few times. Finally, if you have a SIM card installed, a Change Mode window appears with the following message and OK above the left soft key:
SIM card detected. Your device will now
switch to Global mode.​
Pressing the left soft key brings up a Press SEND to activate your phone where SEND is actually an icon of the SEND button. Pressing SEND dials *228 and displays a GEAR icon and the text Programming in progress... . . ." while voice propmpts tell you "To program your phone press 1 . . . "
Pressing "1" plays some badly encoded music along with the text "Connected:" followed by a timer and "SPL unlocked" in red below it.
After a minute or so the screen displays "Programming was successful. Please Wait. Your phone is being reset."
Then, the phone restarts and comes up at the normal home screen displaying the time and date. From here you can restore or set up your applications and data.
So if you back up your data you can even recover from a lost password or a "friend" that locks your phone. I suspect there may be a way to unlock the password without wiping the phone by getting an unlock code keyed to the phone's serial number of DEC number (found under the battery). I didn't need this service as I just got the phone and hadn't put any data on it. If you back up the data and applications with Active Sync you should be safe but I haven't played with active sync much so I can't vouch for its stability and performance.
Hope this helps others with this phone. It's really nice when it works but it seems to have a few software pitfalls as well. Feel free to move this to an HTC Ozone forum should one be set up in the near future.
Max L.
Hard Reset
hi,
i am tried to do the same but still my phone shows HTC logo screen
how i can fix the briced phone
i am in Qatar Middle east (out side of US)
help me to fix the my lovely phone
Great Guide!
Thanks for posting this! My HTC Snap has a broken screen and I wanted to hard reset before I sold it. This was the only place I could find instructions with enough detail to do it without seeing what I was doing!

Pattern Lock Attempt Bug, Locked Out Of X10

Im sure everybody has run into this problem on other android devices but i haven't seen this problem with many x10 owners. It must've unlocked itself and flapped around in my pocket until it incorrectly drew a pattern 5 or more times and somehow pressed the "Forgot Pattern?" button.
So your stuck with a screen that asks for your Gmail account login and ive tried every single combination of correct username and pass to get in but it is impossible ( Account logs in fine on PC ).
Ive read about ways to solve this and have come upon 3 different options.
1. Manual Factory Reset ( It's an option but i don't want to spend hours getting my phone back to how it was )
2. While in a call, ending the call and using a short window of opportunity (.5 seconds) to tinker around with your settings to try and make it possible to access your phone.
3. Download the Android SDK and enter something into the command prompt.
I would like to try option 3 however i heard that your phone must be rooted, i don't know how to go about rooting or if it is even possible for the x10.
Any support appreciated, thanks.
i guess don't use pattern lock is my suggestion. is there something else that can be used instead of pattern lock?
Sagaxide said:
Im sure everybody has run into this problem on other android devices but i haven't seen this problem with many x10 owners. It must've unlocked itself and flapped around in my pocket until it incorrectly drew a pattern 5 or more times and somehow pressed the "Forgot Pattern?" button.
So your stuck with a screen that asks for your Gmail account login and ive tried every single combination of correct username and pass to get in but it is impossible ( Account logs in fine on PC ).
Ive read about ways to solve this and have come upon 3 different options.
1. Manual Factory Reset ( It's an option but i don't want to spend hours getting my phone back to how it was )
2. While in a call, ending the call and using a short window of opportunity (.5 seconds) to tinker around with your settings to try and make it possible to access your phone.
3. Download the Android SDK and enter something into the command prompt.
I would like to try option 3 however i heard that your phone must be rooted, i don't know how to go about rooting or if it is even possible for the x10.
Any support appreciated, thanks.
Click to expand...
Click to collapse
Might sound like a silly suggestion... but have you tried powering off. taking the battery and sim card out.. give it 30 seconds or so then put it all back together again.. might let you try your google account details then..
Did same, had to seus to get back in Lucky was 1st day owning so not bothered.
You mention the call thing, can you not disable the pattern lock whilst in call ?. I didnt know the phone could take a call when locked out so didnt try.

402sh sharp hard reset how?

Hello,
I have a problem with my "sharp softbank aquos 402SH
I setup a pattern lock. Since I have not used the phone for some time I cannot remember the pattern anymore.
I thought an unlock with a hard reset is no problem. But I found no way to boot into recovery mode(tried power and minus button, power and plus button to boot).
Also the device did not show up in adb as a device(Windows 8/Sharp USB driver installed) but was recognized as a storage device.
The user manual says:
"Do not forget pattern, Lock No. passcode or password set for canceling Screen lock(write it down if necessary). If you forget it, visit the nearest SoftBank Shop for recovery procedure."
As I live in Sudan and there are only softbank stores in Japan. So this is not possible for me.
Is there any other way to hard reset the device?
same prob
http://www.recovery-mode.com/android/sharp-aquos-crystal-x.html
Are you sure? Have you tried power-cycling the device? (Let it discharge all the way, and charge it all the way.)
Sharp aquos 402 sh hard reset problem
I have the same problem as the guy from sudan mentioned above, ive forgot screen lock pattern and not been able to get into boot option by hard reseting. I have done every thing like keep pressing and hold volume down key and holding power on key after sharp logo appears i let go the keys but nothing happens. Plz suggest me the solution.
Hi there
i have the same problem
my phone aquos 304 there are no available physical volume rocker button
i forget the password pattern
custom cable data with R jumper to ID pin with zadig software cannot flash the twrp
could someone help me out of this
thx
i also have that kind problem also show to many people but no way found of any to recover my bally please do something
As I think this phone did not get that many updates this might still work. I remember early on back then that i somehow managed to make a pattern that I had not meant to so could not unlock. Also quickly found out I could not get into the bootloader. But I found out you could bypass the lockscreen if you went into the emergency call screen. The thing is, you'd have to make a call then you could use the drop down notifications and enter settings app or something like that. I can't remember clearly, but I could atleast get access. And from there i just disabled the pattern. Don't feel I can recommend this though as it depends on how quick you are, and police services are sort of being misused this way. I remember being frazzled and extremely annoyed at that point as I had only had the phone for a couple of days. Ended up spamming a call three or four times to the cops to bypass without connecting a call. They called me back wondering what the deal was ? oops.

Categories

Resources