Android N and Unpatched Marshmallow Can Bypass Factory Reset Protections

With Android N expected to be shown to the public shortly, and with Android Marshmallow improved in every single way possible thanks to the addition of new features, you would think that added protection would be enabled for the owner of the smartphone incase their device gets misplaced or worst, stolen. However, things are not the way they seem, even with the latest operating system installed on your mobile devices and this is why.

Factory Reset Protection is fairly easy to bypass on New Android Versions

Factory Reset Protection (FRP) is a protection measure introduced by Google to prevent thieves from using stolen Android handsets and snoop through the sensitive matter present inside the storage of these smartphones. While this is a clever way of discouraging thieves from carrying out their activities, this sort of protection can easily be bypassed on Android N preview as well as unpatched versions of Google’s stock-based version of Marshmallow.

So how does Factory Reset Protection work?

For example, if your Google account has been registered on an Android-powered smartphone, and someone decides to restore it to its Factory Default Settings, FRP will immediately ask that you verify important details before going through with this step in order to confirm the identity of the smartphone user. However, here is where things take a sudden nose dive. If a thief successfully manages to take control over your smartphone, they will not just be able to restore it to the device’s factory settings, but they can use the smartphone as if it were their own.

How was this vulnerability located?

Thanks to an Android user named RootJunky, it involved just a few simple steps for him to bypass this little obstacle. There is even a video posted at the bottom showing how easy it is to get past this security feature.

According to a security bulletin, the following has been described about the security issue:

“A vulnerability in the Setup Wizard could enable an attacker who had physical access to the device to gain access to device settings and perform a manual device reset. This issue is rated at Moderate Severity because it could be used to improperly work around the factory reset protection.”

However, this was before the January security patch. Everyone must be thinking that after the security patch was introduced, things would have improved right? It looks like the problem persisted even after the security patch had been implemented in smartphones as depicted in the video below:

This indicates the flawed security measure of Factory Reset Protection, and we are hoping that Google ends up introducing a new security patch for both Android N and Marshmallow that will hopefully close this loophole once and for all.

Image credits: PC Advisor