Sometimes, hacking is good, even if accidental. Google accepted this truth, as theyâve rewarded David SchĂŒtz, a bug bounty hunter who accidentally hacked their Google Pixel device, using a now patched exploit.
The bug was removed in a November update, preventing threat actors with physical access to Google Pixel phones to bypass the screen lock protections and gain access to the device.
David discovered the bug after he forgot his pin code. SchĂŒtz, rebooted his Pixel phone, put in the incorrect pin code three times and then was asked to enter the PUK code.
After entering the PUK code from the SIM card’s original packaging, he chose a new pin code, and got to the âPixel is startingâ state. But something was off.
David commented that – “It was a fresh boot, and instead of the usual lock icon, the fingerprint icon was showing. It accepted my finger, which should not happen, since after a reboot, you must enter the lock screen pin code or password at least once to decrypt the device.”
He played with this process multiple times, and one time he forgot to reboot the phone while changing the SIM card.
As he did before, he entered the PUK code and chose a new pin. This time the phone glitched, and he was on his personal home screen.
David admits that at first he didnât even realise what he was doing. At that point, after calming down a bit, he figured out that this was a full lock screen bypass on his fully patched Pixel 6
David notified Google and following his tip, Google patched the bug. Despite telling SchĂŒtz that someone had reported the flaw before SchĂŒtz did, the company rewarded him with a $70,000 bug bounty for the lock screen bypass.