Skip to content

T1461 Lockscreen Bypass

An adversary with physical access to a mobile device may seek to bypass the device’s lockscreen.

Biometric Spoofing

If biometric authentication is used, an adversary could attempt to spoof a mobile device’s biometric authentication mechanism123.

iOS partly mitigates this attack by requiring the device passcode rather than a fingerprint to unlock the device after every device restart and after 48 hours since the device was last unlocked 4. Android has similar mitigations.

Device Unlock Code Guessing or Brute Force

An adversary could attempt to brute-force or otherwise guess the lockscreen passcode (typically a PIN or password), including physically observing (“shoulder surfing”) the device owner’s use of the lockscreen passcode.

Exploit Other Device Lockscreen Vulnerabilities

Techniques have periodically been demonstrated that exploit vulnerabilities on Android 5, iOS 6, or other mobile devices to bypass the device lockscreen. The vulnerabilities are generally patched by the device/operating system vendor once they become aware of their existence.

Item Value
ID T1461
Sub-techniques
Tactics TA0027
Platforms Android, iOS
Version 1.1
Created 25 October 2017
Last Modified 03 February 2019

Mitigations

ID Mitigation Description
M1012 Enterprise Policy Enterprises can provision policies to mobile devices to require a minimum complexity (length, etc.) for the device passcode. Enterprises can provision policies to mobile devices to cause the device to wipe all data if an incorrect passcode is entered too many times. Both policies would mitigate brute-force, guessing, or shoulder surfing of the device passcode. If desired, enterprises can provision policies to mobile devices to disallow biometric authentication. However, biometric authentication can help make “using a longer, more complex passcode far more practical because you don’t need to enter it as frequently.”7
M1001 Security Updates -
M1006 Use Recent OS Version -

References

  1. SRLabs. (n.d.). Fingerprints are not fit for secure device unlocking. Retrieved December 23, 2016. ↩

  2. Zack Martin. (2016, March 11). Another spoof of mobile biometrics. Retrieved September 18, 2018. ↩

  3. Sean Keach. (2018, February 15). Brit mates BREAK Apple’s face unlock and vow to never buy iPhone again. Retrieved September 18, 2018. ↩

  4. Apple. (2015, November 3). About Touch ID security on iPhone and iPad. Retrieved December 23, 2016. ↩

  5. Andy Greenberg. (2015, September 15). Hack Brief: Emergency Number Hack Bypasses Android Lock Screens. Retrieved December 23, 2016. ↩

  6. Chris Brook. (2016, November 17). iOS 10 Passcode Bypass Can Access Photos, Contacts. Retrieved December 23, 2016. ↩

  7. Apple. (2016, May). iOS Security. Retrieved December 21, 2016. ↩

Back to top