Sticking with the theme this week, I have been bored and haven’t been able to sleep well. I decided to try my hand at brute forcing the PIN on my Samsung Galaxy S3. Annoyingly enough the Android operating system thought people would do this and after 5 failed attempts you have to wait 30 seconds. Luckily, that doesn't change so automating will be easy. I have seen Hak5’s rubber ducky do this attack as it simply emulates a keyboard. So I decided to try it with my Arduino, and it works just fine. If you went from 0000 - 9999 that would take roughly 16 hours, the odds are you would get it before then.
I also tried to play with other authentication types on my phone. The most interesting was the pattern type which now forces you to create a backup PIN. If this is set and you can’t get the pattern you can brute force the backup PIN all day and it doesn't have the 30 second delay. After 5 failed swipe attempts you get the option to enter your backup PIN. See the image below. That makes for much faster brute forcing.
The Arduino Sketch below first tries the top 20 PIN’s and then starts its brute force cycle. Yes, it will repeat those 20 eventually but we will try those first, just in case.
For this attack to work you will need an Arduino Leonardo, or an Arduino that can act as a HID (Human Interface Device), an USB OTG (on-the-go) cable and a target device. I always set my HID sketches to work with a switch as I do not want to race the clock trying to upload a new sketch.
In all seriousness this would be a last resort type of thing for me, it’s going to take a long time. I would try to narrow it down somehow, like eliminate the 0 range such as 0000-0999. Do most people start with a zero maybe not?
Finally, the backup PIN brute force in my opinion is a real issue; you could brute force that fairly quickly.