this post was submitted on 06 Jun 2024
1 points (100.0% liked)

Technology

59601 readers
2940 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
 

This is a very entertaining and educational article, giving insights into the methods used by thiefs to try and get access to your phone data.

I don't like Apple but it's great that their security is so good when it comes to this.

you are viewing a single comment's thread
view the rest of the comments
[–] Nurse_Robot@lemmy.world 0 points 5 months ago* (last edited 5 months ago) (11 children)

I guess just anecdotally. I have a pixel 7, I'm pretty confident I could factory reset the device without 3rd party authentication. Also, from the tech channels I follow, I think I could recover my data if I forgot the password. Android has always felt more "free"and customizable, and I love it for that. But I also think that freedom allows for more exploits. It's a trade off that's worth it to me, personally. But if I had illegal shit to hide on my phone, I'd probably do it on an apple device.

Edit: just checked. I can completely bypass all my locked down Google Pixel settings to factory reset my phone pretty easily if I press the right keys in the right order. It would be pretty easy to steal and resell my phone.

[–] Shadow@lemmy.ca 0 points 5 months ago (2 children)

Same for Samsung afaik. Pop into the bootloader and just wipe everything.

[–] Aceticon@lemmy.world 0 points 5 months ago

If recently upgraded an old Samsung tablet (Tab A6 from 2016) to Lineage OS and not only do you have to remove the Google Account before flashing just the TWRP to be able to just start replacing the actual OS, but there is a configuration flag that can only be changed in the stock OS logged in to that Google Account and with Dev Mode enabled to, after you replace the OS, allow the custom OS to actually work (if you don't do it the device with the custom OS will go into a boot fail loop as soon as you restart it).

It was actually a PITA to do that upgrade of my own device because of that (I had to reinstall the old OS and log in to the old account just to toggle the "Allow OEM install" option after which I could install Lineage OS ... again ... without the device going into a boot fail loop on the first restart)

This is on a Samsung device that's almost 8 years old so it would be a bit strange if they went back on it since, especially as it's in the best interest of Samsung to make it hard for people to upgrade their devices away from the enshittified Samsung software.

load more comments (1 replies)
[–] Yamayo@lemmy.world 0 points 5 months ago (1 children)

Edit: just checked. I can completely bypass all my locked down Google Pixel settings to factory reset my phone pretty easily if I press the right keys in the right order. It would be pretty easy to steal and resell my phone.

Mind to share what "Keys in the right order" are? I mean a link, of course, because in my experience you just can't do that with a locked bootloader.

[–] devnull406@lemmy.world 0 points 5 months ago (2 children)

Enter recovery mode and choose factory reset. The specific key combination for your device may vary.

[–] Yamayo@lemmy.world 0 points 5 months ago

You think we're still in 2010? It's been a while since you need to unlock the bootloader first. And no, you can't do it with the device locked.

[–] thequantumcog@lemmy.world 0 points 5 months ago* (last edited 5 months ago)

This don't work anymore, now they have frp protection which requires google authentication to the previous account after reset

[–] wreckedcarzz@lemmy.world 0 points 5 months ago (1 children)

If you do it the manual way - not unlocking the phone and doing it through settings - you can wipe it sure, but when you try to set it up it requires the prior Google account credentials to proceed. No creds, no passing go, just a shiny brick. It's been like that for years.

Also might I recommend you take a gander at GrapheneOS for more intense security capabilities than stock.

[–] Orygin@sh.itjust.works 0 points 5 months ago

Not sure about the latest Android version, but I managed to unlock and bypass a phone which had factory reset protection, and as far as I know a lot of vendors like Samsung have their own exploit available.
Using this you can manage to get to the settings app (while still locked, waiting for the previous owners google account) and remove the account, add your own or disable the security.
Done!

[–] TrickDacy@lemmy.world 0 points 5 months ago* (last edited 5 months ago) (32 children)

As everyone is pointing out you're just wrong about this.

Also apple is overbearing AF. I recently had several back and forths with my IT department about an old company mac laptop I used to have. Since I had signed into my apple account once, Apple permanently tied that laptop to my account and wouldn't allow the fucking IT department to fully wipe it.

Keep in mind also that I would have preferred to not have or use an apple account (they kind of force it on you, even asking you to login to iCloud constantly even if you've literally never used it once), and even though I could login to the apple account in my browser and see that the laptop wasn't listed under my devices, IT was still locked out.

Literally the only way to fix this was giving the IT dept my apple password so they could authenticate then sign out of it. There was nothing I could do remotely about it. This is a security issue in itself. Zero reason I shouldn't be able to use my account remotely to remove or sign that device out. Zero reason I should have to give my password to another human. Except for apple being shit.

The apple security theater is widely believed but it's still largely theater.

[–] Juvyn00b@lemmy.world 0 points 5 months ago (2 children)

I get this as being a bit of a hurdle, but wouldn't a good option in hind sight be to create a separate work related apple account based on your work email? I've done that in the past with various companies for iPhones and MacBooks. Makes it cleaner to return the device and doesn't compromise my personal account should they ultimately need my credentials on the non-owned-by-me device.

[–] TrickDacy@lemmy.world 0 points 5 months ago

I eventually did do that, but apparently at the time that I was nagged into iCloud for the 1000th time I was quite annoyed and just used my personal account like an idiot.

load more comments (1 replies)
[–] BeardedBlaze@lemmy.world 0 points 5 months ago (1 children)

Your "IT" could've literally do fresh install of MacOS. I'm not a fan of Apple, but that's just silly.

[–] TrickDacy@lemmy.world 0 points 5 months ago

Pretty sure that's what they were trying to do. I know for sure that on iPhones, if you ever sign in (which I think is required), wiping the phone doesn't matter, it's still locked to that account somehow -- a ROM chip on the board stores the account info somehow I think? I think their computers work the same way now.

On other systems, logging in means that: you've logged in. And you should be right: wiping the OS should always remove any login/account status. If Apple wants to provide some system like this for people worried about theft, cool, let them opt into it. But don't force every user to.

load more comments (30 replies)
[–] Thatuserguy@lemmy.world 0 points 5 months ago (1 children)

For what it's worth, they're trying to fix that with Android 15. Not sure if this is one of the features they'll also be back porting to older phones too like this article briefly touches on, but either way it sounds like if you factory reset the phone, it can't be set up again unless they know your login: https://www.wired.com/story/android-15-theft-detection-lock/

Google says in a blog post, the company is adding four data protection features that can help keep your information locked down. The first stops your phone from being set up after a factory reset, unless the person knows your login details. “This renders a stolen device unsellable, reducing incentives for phone theft,” Google vice president Suzanne Frey writes.

[–] technohacker@programming.dev 0 points 5 months ago (2 children)

Doesn't that already exist as the Factory Reset Protection (FRP) partition?

[–] wreckedcarzz@lemmy.world 0 points 5 months ago (1 children)

Yeah, I've had to wipe pixel devices the dirty way and it prompts (requires) your credentials to continue. Maybe it's a pixel exclusive, and others are getting it via a15?

[–] thequantumcog@lemmy.world 0 points 5 months ago

No, its not exclusive. But FRP can be bypassed if you know the right tools.

[–] Thatuserguy@lemmy.world 0 points 5 months ago

Honestly not too familiar with that. I imagine if they're touting this as a new thing, FRP either does something different or was lacking compared to this in some way.

Though it is Google, they could have just killed FRP in favor of this and added messaging features like they do with everything else

[–] lurch@sh.itjust.works 0 points 5 months ago

AFAIK you can't wipe the IMEI and if you report it stolen to providers they will block it from using their networks. (It will only be able to use wifi.)

[–] avidamoeba@lemmy.ca 0 points 5 months ago (1 children)

You can factory reset it easily. You can't use it without the previous Google account credentials afterwards. You can't reuse a stolen Pixel which has Google account logged into it.

[–] wreckedcarzz@lemmy.world 0 points 5 months ago

Ding ding ding, I can confirm this. I thought it was for all devices, but I guess not.

[–] muntedcrocodile@lemm.ee 0 points 5 months ago

Im pretty sure u cant fuck with a device that has a locked bootloader without unlocking said bootloader which requires u know the password. And u definatly cant recover data without passcode unless u can extract the hash from whatever chip holds it (shouldn't be possible if u have a tpm) and bruteforce it. Ur data should be encrypted and u shouldn't be able to tamper with os without unlocking bootloader which once unlocked will wipe all device data. Might be possible if u do some dodgy power injection directly into some of the chips but thats pretty advanced stuff.

load more comments (3 replies)