Open Sesame! Design and Implementation of Backdoor to Secretly Unlock Android Devices

Junsung Cho, Geumhwan Cho, Sangwon Hyun, and Hyoungshick Kim⁺

Sungkyunkwan University, Republic of Korea
{js.cho, geumhwan, swhyun77, hyoung}@skku.edu

Abstract

This paper presents a practical design of backdoor to permanently bypass the screen lock mechanisms on Android devices. Our design has many advantages such as difficulty in detecting backdoor, fast execution time and low power consumption. The key feature of our backdoor is remote triggering that allows the backdoor to be temporarily triggered and executed through push notification services also used by many normal applications. Furthermore, in our proof-of-concept backdoor, about 98% of 4-digit PINs and screen lock patterns were cracked within 5 seconds, and only a small amount of power was consumed. We show the stealthiness of our backdoor to effectively evade the existing malware detection tools (55 anti-virus scanners provided by VirusTotal and SandDroid).

Keywords: Android, Malware, Backdoor, Firebase

+: Corresponding author: Hyoungshick Kim
Department of Software, Sungkyunkwan University, #27324 2nd Engineering Building, Sungkyunkwan University, 2066 Seobu-ro, Jangan-gu, Suwon-si, Gyeonggi-do, Republic of Korea
Tel: +82-(0)31-299-4324

Journal of Internet Services and Information Security (JISIS), 7(4):35-44, November 2017 [pdf]

DOI: 10.22667/JISIS.2017.11.30.035