Industry News

Cyanogen Mod Android ROM Logs Unlocking Screen Patterns

The highly-popular alternative Android ROM known as Cyanogen Mod has been discovered to log lock-screen swipe gestures, according to developer Gabriel Castro. Cyanogen Mod, one of the most spectacular developments of alternative ROMs for Android phones, runs on more than 2.5 million devices worldwide.

Cyanogen Mod 9 Lockscreen. The unlock pattern gets logged locally

The committed code on the project’s space on GitHub, has one line that escaped initial review and managed to get into the official distribution.

“I’m really surprised nobody caught this,” wrote the developer in the commit log. Fixing the issue did not require extra patching, as the one-liner got simply commented. “This could also be solved by commenting the code out or just removing the line without breaking anything.”

The offending line of code that got axed.

The line of code that caused the issue got snuck into the project in early August when the fixed 3×3 grid format for the lockscreen pattern was modified to automatically scale size by adding a PATTERN_SIZE variable. Recording these unlock patterns are similar to logging passwords or unlock PIN numbers, but has not been exploited in the wild. However, simply having these details logged on the PC may expose the user to unnecessary security risks.

About the author

Bogdan BOTEZATU

Bogdan Botezatu is living his second childhood at Bitdefender as senior e-threat analyst. When he is not documenting sophisticated strains of malware or writing removal tools, he teaches extreme sports such as surfing the web without protection or rodeo with wild Trojan horses. He believes that most things in life can be beat with strong heuristics and that antimalware research is like working for a secret agency: you need to stay focused at all times, but you get all the glory when you catch the bad guys.