CyanogenMod (In)Secure Folder Lock !

********

This is an older post (written around ~2015) and ported from my old blog. Please excuse if there are any mistakes or inaccuracies. If you find any issues, please head over to the home page > contact me. Thanks.

********

Hey Guys, As others in the Hacker’s community,I’m also a lover of OpenSource and also our dear friend Android :-) . From a couple of days, I’ve started getting interested into Android Dev stuff and thats where I heard the name CyanogenMod Roms.. CM 12, Oh Yeah one of the best roms I’ve ever seen.

I was really fascinated by the powerful features of CyanogenMod and starting falling in love with it. Being exposed to the hackers community, I prefer my surroundings to be secure and I see everything in a security prespective. There I saw an awesome feature called folder lock. I’ve googled about that and saw that it was one of the loved features of CM. Here are some of the snapshots of how folder lock looks like in CM

Snapshot of how folder lock looks like

So The main question arises is “ Is this really secure enough ? I mean does this really protect ?” Well, I found a simple bypass for this.

You can simply open the PlayStore application and search for the application you want to open and on the right side you can see an option called “Open”. Just click on that and your done! Even though the application is secured by folder lock, the application opens!

Hilarious & Simple isn’t it?! I don’t think I need to explain the technical reasons behind this.. Want to learn more? Shoot a mail at pbssubhash [at] gmail.com

Mitigation ? :- Just encrypt even the play store app & Switch off USB Debugging too :P

At the first sight I found this and want to share it with all my folks in the InfoSec community so that they could secure themselves.

Didn’t report anyone. Yet anyone can submit this bug to the CM dev’s because they’ve done really great job.

Will be blogging anymore bugs I encounter/discover :-) Looks like someone else has identified this https://forums.oneplus.net/threads/lock-folder-disappeared-leaving-apps-unreachable.94367/?hc_location=ufi#post-4610060 http://www.reddit.com/r/cyanogenmod/comments/2abb6y/m8_question_what_does_protected_apps_do/?hc_location=ufi Would like to give appropriate credits to them :-) and would like to thank Anand for letting me know about this.! Bye for now!