Database Users

Recovery Password Protection?

As the title says.. is it within the scope of any dev to have some kind of lock or password protection on accessing recovery? This would obviously have to be optional.
Wavesecure is kinda rendered useless if someone could easily flash another rom on the phone before the user can get to wiping all data.
I'm not so concerned about getting a phone back after it's stolen... but i'm much more worried about the information i may have stored on it.
Is this even possible?
Thanks in advance
Alex

a) If you flash another ROM to remove wavesecure, you would have to wipe first and therefore your personal data would be gone anyway.
b) You can install a recovery via adb as far as I know so if the user knew enough to boot into recovery mode, they could flash another recovery and circumvent the password anyway

Hmm, you'd need to password protect fastboot too wouldnt ya?

+1
I was gonna post this. I mean if phone was stolen, and wavesecure did prevent them using it, a wipe will remove it.

Well, ask ninpo maybe over at villainrom site.
Dunno if he would do it, but he modified recovery for villainrom 12 so it could wipe dalvik2cache properly iirc

I would also like it. And flashing over adb is for a newcomer harder then pressing the home button at booting

Seelbreaker said:
I would also like it. And flashing over adb is for a newcomer harder then pressing the home button at booting
Click to expand...
Click to collapse
True.
You could always install the 007 spl if you were that bothered. But I don't recommend that.
I will look into wave secure, as I have a few ideas about things to do.
But remember most thieves would not manage to flash a rom, but a wipe using power + call (I think) is easy.
Also remember that wave secure is a great program, and it has improved loads since I first contacted them to show a way to add your own un approved sim to the allowed list. But I can still bypass it in about 30 seconds, just like any other security measure your phone may use (eg pattern lock or third party app locker).
So whilst a thief in theory could do this, it's unlikely in my opinion. They would need a fair bit of android knowledge, and anyone who knows the inner workings can get rid of any user security measure in seconds.
And btw, when in say I can bypass ws in 30 secs, that don't involve removing the app. I mean bypass that lock screen completely with the app installed

just curious: this possibility doesn't involve activated USB debugging in the device? So you do some trick during boot... or something else I just can't think of?

xdafalter said:
just curious: this possibility doesn't involve activated USB debugging in the device? So you do some trick during boot... or something else I just can't think of?
Click to expand...
Click to collapse
I have more than one method. But I used methods that are unlikely to be found. One certainly can't be fixed, as it is inherently a flaw on linux, though by design. For this reason I won't be disclosing it, and I'm sure people understand.
But yes, usb debugging is useful for bypassing it, though I can still get round it even if you have disabled it

anon2122 said:
But yes, usb debugging is useful for bypassing it, though I can still get round it even if you have disabled it
Click to expand...
Click to collapse
Interesting... I will give it some thought as I like to know stuff
Knowledge brings fear (from Futurama) but don't be evil (Google)

thanks for the replies.
In the end any security can be broken and circumvented.. i just like the idea of layering as much as possible... again i don't expect to be able to get my phone back or stop someone from selling it (given how common imei spoofing seems to be)..
i just want to have time to run a remote wipe from another location.
I do turn off usb debugging whenever i'm not likely to be at a PC.
I know i'm being paranoid... but with good reason

Bantu85 said:
thanks for the replies.
In the end any security can be broken and circumvented.. i just like the idea of layering as much as possible... again i don't expect to be able to get my phone back or stop someone from selling it (given how common imei spoofing seems to be)..
i just want to have time to run a remote wipe from another location.
I do turn off usb debugging whenever i'm not likely to be at a PC.
I know i'm being paranoid... but with good reason
Click to expand...
Click to collapse
Wanna try something? Turn off USB debugging, then try and connect via adb.
Try "adb shell" and see what happens.

I'm not sure what you are up to, but it cannot connect (no device connected or similar output)... and this is the expected result.
Did you want to prove something else?

Yeh adb shell with usb-debugging off just gives "error no device found".

xdafalter said:
I'm not sure what you are up to, but it cannot connect (no device connected or similar output)... and this is the expected result.
Did you want to prove something else?
Click to expand...
Click to collapse
Nah, just wondered. Some phones used to have persisting ADB, which meant that you could get a connection even when that was disabled IIRC.
But remember that you can get adb on boot regardless of setting AFAIK, as well as in recovery

so, if we would have a pw protected recovery/spl and use a kernel with no adb compiled in, where would then be your basis to break in?

xdafalter said:
so, if we would have a pw protected recovery/spl and use a kernel with no adb compiled in, where would then be your basis to break in?
Click to expand...
Click to collapse
Or perhaps limit the use of ADB so that it can only be used while booted into the recovery and after the pw-protection of it has been passed.

[Q] Locked Out by Android Device Manager (help!)

I don't know if anyone is going to believe this. I decided to test Android Device Manager's lock feature. Worked fine on my tablet. Did not work right on my phone. Now I am locked out of my phone. It would not accept the PIN I selected. I tried sending different PINs and it won't accept any of them! When I change the "message," it does change but the PIN doesn't work.
1) Is there any way to fix this???
2) If not, ugh, if I send an ERASE command, will I be able to get back into the phone?
Help!!
Thanks!
Paul
(I don't know how to prove this isn't a stolen phone - I have full access to it via Device Manager in my google account)

Talked to AT&T. I was screwed. FYI for anyone else... The Android Device Manager Lock may not work right on the AT&T Galaxy S4.

The entire point of locking a phone through ADM is to render it useless for anyone that has stolen it or "found and tried to use it" if it was lost. It's not intended as a tool to be used day to day or for any other reason than loss or theft. As such, I don't see why there would be a need to re-activate the phone after locking it through ADM.
However, if it simply won't let you unlock the lock screen, why not use ODIN to re-flash the firmware and start fresh with an unlocked lock screen?

scott14719 said:
The entire point of locking a phone through ADM is to render it useless for anyone that has stolen it or "found and tried to use it" if it was lost.
Click to expand...
Click to collapse
I should have posted more details. Actually, you can factory reset the phone and it comes out of it fine, albeit factory reset. It doesn't make the phone useless. It just protects the data on your phone with the standard PIN lock screen. It's certainly no kill switch.
To add more info to this - it literally changes the lock screen setting to PIN lock. So, for example, on my tablet, I had a pattern lock. Even after I unlocked it with the ADM PIN I sent, the next time it locked, it was the same PIN lock. I had to go back and change it to the pattern lock.
This is unlike the 3rd party solutions I have used in the past (e.g. Lookout, AVG) which overlay their own lock onto the phone one time only. Once you unlock through their PIN system, the device reverts to whatever locking method you had been using (or none).
This is just what I learned from the experience. Maybe people knew this but it was interesting to me.

PaulQ602 said:
I should have posted more details. Actually, you can factory reset the phone and it comes out of it fine, albeit factory reset. It doesn't make the phone useless. It just protects the data on your phone with the standard PIN lock screen. It's certainly no kill switch.
To add more info to this - it literally changes the lock screen setting to PIN lock. So, for example, on my tablet, I had a pattern lock. Even after I unlocked it with the ADM PIN I sent, the next time it locked, it was the same PIN lock. I had to go back and change it to the pattern lock.
This is unlike the 3rd party solutions I have used in the past (e.g. Lookout, AVG) which overlay their own lock onto the phone one time only. Once you unlock through their PIN system, the device reverts to whatever locking method you had been using (or none).
This is just what I learned from the experience. Maybe people knew this but it was interesting to me.
Click to expand...
Click to collapse
Thanks for the additional info. It's nice to know how it works or is supposed to work. Starting mid-2014, all cell phones sold in the US will be required to have a "kill switch" available. I wonder if it will operate in the same way. I guess time will tell. Again, thanks for the info.

I do wish people who don't read a persons message properly and are not informed on the subject wouldn't waste every ones time posting their drivel aye Scott!
You like so many others state the obvious, I did like your post Paul and thank you for taking the time to post
I have had issues with ADM and have found the application about as useful as Scott's drivel

[Q] Screen broke, lockscreen prevents data access. Options?

hey there everyone,
I will make this as short as I can so you guys can read it. There is a company that fixes my screen, but they (for some reason!) cant promise my data is safe.
Researched myself, I know some suggestions are technically exploits and silly, but I still would like to ask at least, no matter how unlikely.
So.. lockscreen prevents acess to my photos. I disabled G+, which I regret now. Phone is in plane mode. Touchscreen doesnt response. ADB developer option is not activated.
Can I ..
- use "Find my phone" to deactivate the plane mode (could download an app like airdroid maybe)
- Email Google, send them proof and ask them to remotely unlock my phone? Serial Number, billing details etc.
- Activate bluetooth somehow to connect a bluetooth mouse
- Force my phone to reset its options?
- wipe my phone safely and recover the data over an 3rd party app (recovery tool).. maybe over find my phone?
- Somehow circumvent the lockscreen (yes, silly .. I know)
I know about this
HTML:
http://forum.xda-developers.com/nexus-4/help/nexus-4-to-copy-data-broken-touch-input-t2415195
. If really necessary I will fight myself through it.
Thanks everyone who helps!!

nexkon said:
hey there everyone,
I will make this as short as I can so you guys can read it. There is a company that fixes my screen, but they (for some reason!) cant promise my data is safe.
Researched myself, I know some suggestions are technically exploits and silly, but I still would like to ask at least, no matter how unlikely.
So.. lockscreen prevents acess to my photos. I disabled G+, which I regret now. Phone is in plane mode. Touchscreen doesnt response. ADB developer option is not activated.
Can I ..
- use "Find my phone" to deactivate the plane mode (could download an app like airdroid maybe)
- Email Google, send them proof and ask them to remotely unlock my phone? Serial Number, billing details etc.
- Activate bluetooth somehow to connect a bluetooth mouse
- Force my phone to reset its options?
- wipe my phone safely and recover the data over an 3rd party app (recovery tool).. maybe over find my phone?
- Somehow circumvent the lockscreen (yes, silly .. I know)
I know about this
HTML:
http://forum.xda-developers.com/nexus-4/help/nexus-4-to-copy-data-broken-touch-input-t2415195
. If really necessary I will fight myself through it.
Thanks everyone who helps!!
Click to expand...
Click to collapse
Do you have a custom recovery? ADB should work if you boot in recovery and connect your phone.

abaaaabbbb63 said:
Do you have a custom recovery? ADB should work if you boot in recovery and connect your phone.
Click to expand...
Click to collapse
thanks, everything is stock. usb debugging deactivated. plane mode. lock screen.
I'll give up and just let it repair. if they lose my data.. let's not think that far.

nexkon said:
thanks, everything is stock. usb debugging deactivated. plane mode. lock screen.
I'll give up and just let it repair. if they lose my data.. let's not think that far.
Click to expand...
Click to collapse
Wait wait.
Do you have an unlocked bootloader? If not.. then yeah.. no other way.

Replace the screen yourself. Buy a screen assembly off eBay ($45USD for just the screen/digitizer, $60 for one installed in a new bezel - far easier). It's not that hard to do, honestly. Watch some videos on youtube and study the device tear-down on ifixit.com.

Direction Lock - New way to unlock your phone (Hidden feature on the Galaxy S6)

With direction lock, you can unlock your phone by drawing a pattern on it...pretty cool I think
https://youtu.be/iIQUWxuLhOI

Considering I'll be coming from a G2, it's a far cry from knock on. I will miss knock on more than anything on my G2 I'm sure. It might break the boredom of just swipe to unlock, but leaves more room for error and will take longer.

natypes said:
Considering I'll be coming from a G2, it's a far cry from knock on. I will miss knock on more than anything on my G2 I'm sure. It might break the boredom of just swipe to unlock, but leaves more room for error and will take longer.
Click to expand...
Click to collapse
Knock on was very cool, pressing the home button once with the fingerprint reader is cooler.

Well, I'm getting an S6, so I'm certainly willing to give it a shot.

After activating the direction lock feature I have run into a very serious issue. An OTA software update came in from AT&T after which the phone did a reboot. I cannot unlock the phone as it no longer recognizes the direction lock pattern and sadly, it is requiring that specific unlock method for the first unlock after reboot. Samsung tells me there is no way around this except a full master reset which the data loss would be devastating! I cannot locate any software that will pull the data via USB either as the model is an S6 Edge SM-G925A which is not offered via FonePaw, Phone Doctor or Mini Tool. Since the direction lock is located in the Accessibility menu the "unlocking" methods don't work either as the values are apparently in a different location. I seriously need some help with this issue. Losing all the critical data from my last backup to now is beyond stressing me out as it is vital as well as having some very sentimental items. If I could just find a way to either pull the data or explore the phone via third party software I would be one very happy man!! Please, if there is anyone that has an idea, I am willing to try just about anything to prevent a factory reset! Thank you very much in advance!! And yes, I have searched and read and searched and read..... over 5 hours worth of time spent online trying to get this solved... BTW, the phone does not have USB debugging enabled and is not rooted. Just stock Android 7.x

Forgot Pin on Mom's Phone

Hi,
So today I changed the pin for my mom's phone and the completely forgot it.
She has a lot of Photos on the phone that she wants to keep, but she has not turned on the backup to google photos option
Is there a way to unlock the phone or recover the photos ?
I have entered the wrong pin multiple times and I still cant see the forgot password option.
Pls help or else mom will kill me.

I hope there is no solution because it would be big security problem.
Your mother maybe using google photos cloud so dont be worry

This poses a security risk for those who lost their phones, so I hope there's no easy way around it.

RIP OP

I also hope there isn't a remedy. I don't mean to sound negative and not help but look at it from our side.

I once had a phone that needed a pin to unlock after being fully booted. Was able to go into recovery without it though.
But on 6t I think the pin encrypts the partition, so no way of bypassing it.
[irony] Maybe tell some intelligence agency that there is terrorist evidence on the phone, see if they have a "special key". [/irony]

elchmartin said:
I once had a phone that needed a pin to unlock after being fully booted. Was able to go into recovery without it though.
But on 6t I think the pin encrypts the partition, so no way of bypassing it.
[irony] Maybe tell some intelligence agency that there is terrorist evidence on the phone, see if they have a "special key". [/irony]
Click to expand...
Click to collapse
I agree.

Can you not plug in your USB cable and copy the contents off the phone onto your laptop?

KashMiester said:
Can you not plug in your USB cable and copy the contents off the phone onto your laptop?
Click to expand...
Click to collapse
Not without unlocking and enabling USB transfer

Just to be sure, it is the pin for the phone and not the simcard right?

superiscch said:
Just to be sure, it is the pin for the phone and not the simcard right?
Click to expand...
Click to collapse
Good point

Is it not possible to boot to recovery then factory reset it.........

xobtik said:
Hi,
So today I changed the pin for my mom's phone and the completely forgot it.
She has a lot of Photos on the phone that she wants to keep, but she has not turned on the backup to google photos option
Is there a way to unlock the phone or recover the photos ?
I have entered the wrong pin multiple times and I still cant see the forgot password option.
Pls help or else mom will kill me.
Click to expand...
Click to collapse
Get your plot ready then.
You have to format data.
Hopefully you can remember the password or pin.
There is far to many security measures in place

you could by having USB debugging on don't know if it's against rules to tell you or just have them email you don't they still email the password to email reg. on phone

There is simply NO way to access the contents without the encryption key. No app from google that claims it can, not google, not even the NSA or anyone but the key holder can. Trust me, you messed up and there is no other way but to remember what it was or completedly reset the phone. After you reset you will be asked password for the account that was last used there. not worth even trying mate.

I wouldnt normally try to help in a situation regarding security but check out this link: Bypass lock screen PIN all One Plus Devices! Might help!
Good luck and let us know how it turns out :highfive:

That worked for me! Thanks so much!

Scott said:
I wouldnt normally try to help in a situation regarding security but check out this link: Bypass lock screen PIN all One Plus Devices! Might help!
Good luck and let us know how it turns out :highfive:
Click to expand...
Click to collapse
+1 this worked for me too

elchmartin said:
[irony] Maybe tell some intelligence agency that there is terrorist evidence on the phone, see if they have a "special key". [/irony]
Click to expand...
Click to collapse
Not really for 6T. File Based Encryption that's used by OnePlus doesn't help here either. There may be a way for OnePlus 6 tho since it uses a different key to sign its boot image.
It may be possible to change current password by using Google Find My Device (https://www.google.com/android/find), but i haven't used it for a long time so i'm not sure at this point.