The PIN codes used to protect Android smartphones offer a useful line of defense against criminals - unless, that is, your device falls into the hands of the robot R2B2.
R2B2 - it stands for Robotic Reconfigurable Button Basher - was designed by two researchers from iSec and will be shown off at the Black Hat security conference in Las Vegas. R2B2 can “guess” any Android 4-digit PIN code within 20 hours, the researchers claim - by simply trying every possible combination. A video of R2B2 at work can be seen here.
Justin Engler of iSec says that many companies argue, "R2B2 can also handle more esoteric lockscreen types such as pattern tracing. R2B2 can crack a stock Android 4 digit PIN exhaustively in 20 hours."
“There’s nothing to stop someone from guessing all the possible PINs,” says Engler,. “We often hear ‘no one would ever do that.’ We wanted to eliminate that argument. This was already easy, it had just never been done before. Products relying on PINs or short passwords need to defend against online attacks. Our hope is that with the information for building these devices available to the public, vendors will implement software protections against this trivial hardware brute force attack.”
The researchers admit, however, that R2B2 would be foiled by an iPhone - the device “times out” after repeated wrong answers, according to a report in Forbes.
“R2B2 can operate on touchscreens or physical buttons. Times for other devices vary depending on lockout policies and related defenses,” say the researchers. A companion password robot, C3B0, is designed to work with capacitive touchscreens, and remains a work in progress.
“Capacitive Cartesian Coordinate Bruteforceing Overlay (C3BO) is a combination of electronics designed to electrically simulate touches on a capacitive touch screen device. C3BO has no moving parts and can work faster than R2B2 in some circumstances,” say the researchers.
