Major security flaw found in AT&T's upcoming Samsung Galaxy S II device

Galaxy S II
We love to think that once we set a pattern lock -- or any sort of lock -- on our beloved Android device that our information is safe, right? Well, the guys at BGR noticed that the information on the upcoming AT&T version of the Samsung Galaxy S II isn't so safe behind a once trusted pattern lock, and that it can quite simply be bypassed.
All you have to do to get around this is wake the device using the lock key, then let the screen time out, then wake it again with the lock key and you can access all the data. We have seen similar issues with Samsung in the past on the Fascinate, so maybe it is time they take a step back from all the added customizations. We can confirm that it happens on our review unit of the AT&T version, but the Sprint version does not suffer from the same issue.
Note that this indeed is a problem with all of the included locking mechanisms -- pattern, pin and password.
Hit the break check out a quick video of it in acti




Samsung and AT&T are aware of the user interface issue on the Galaxy S II with AT&T. Currently, when using a security screen lock on the device, the default setting is for a screen timeout. If a user presses the power button on the device after the timeout period it will always require a password. If a user presses the power button on the phone before the timeout period, the device requests a password – but the password is not actually necessary to unlock it.
Samsung and AT&T are investigating a permanent solution. In the meantime, owners of the Galaxy S II can remedy the situation by re-setting their time-out screen to the “immediately” setting. This is done by going to the Settings ->Location and Security->Screen unlock settings->Timeout->Immediately.

Categories: