How can a lost locked phone in airplane mode be unlocked?


Question

I lost my Android phone on vacation that was in airplane mode (Moto G5, v7 updated). It was protected by fingerprint and swipe. I almost always use the fingerprint to unlock, but do very occasionally use the swipe.



I locked it online remotely and remotely logged out of it when I realized it was lost several hours later. The timeout interval should be only 1 or 2 minutes.



I was hoping to recover it in some fashion, so I didn't remotely wipe it, secure in the knowledge that it couldn't be unlocked.



So I was surprised to be contacted two days (!) after I lost it on my other devices and accounts via an instant messaging app on the phone by someone who claimed to have found the phone and was looking for the owner.



In shock I didn't reply and quickly used Device Manager to remotely wipe the phone immediately. I also changed all my Google passwords for the accounts on the phone. I checked the Gmail logins and noticed none outside of my possession. I also checked Google Maps timeline and didn't see anything outside of my possession. Oddly, though, in Device Manager I clearly did see the phone located in the city I lost it, but a distance away from where I was.



A few questions:




  • How could a locked phone with a recent Android OS be unlocked, taken out of airplane mode, and home screen accessed?

  • How could the remote lock not work, assuming somehow someone opened up the phone within the lockout interval?

  • I saw the phone in the city I lost it on Device Manager (where I executed the remote wipe). How could it be there, but nowhere visible in my Google Maps timeline or Gmail login history?

  • Is there something I might be forgetting to do security wise?



Thank you.


Answer


How could a locked phone with a recent Android OS be unlocked, taken out of airplane mode, and home screen accessed?




It wasn't. The person simply pulled out the sim card from your device, added into some other device and installed WhatsApp on it. WhatsApp doesn't have any login authentication, it will simply let anyone use it as long as they have access to sim card. This also explains why he/she could post in one your groups and not directly PM some contact (he/she doesn't have any of your contacts).




How could the remote lock not work, assuming somehow someone opened up the phone within the lockout interval?




Not possible in the 1-2 minute lockout interval you mentioned. Any kind of exploit will require at least few hours of work.




I saw the phone in the city I lost it on Device Manager (where I executed the remote wipe). How could it be there, but nowhere visible in my Google Maps timeline or Gmail login history?




Maps timeline isn't 100% accurate and up to date. Device Manager pings for real-time location. GMail login history shows only places where you actually logged in. You were already logged into your accounts when you went to that place, unless you didn't remove the account and added it back, it won't show login attempts in GMail.



I don't see any signs of breach in security of your device from the information you have provided.


Topics


2D Engines   3D Engines   9-Patch   Action Bars   Activities   ADB   Advertisements   Analytics   Animations   ANR   AOP   API   APK   APT   Architecture   Audio   Autocomplete   Background Processing   Backward Compatibility   Badges   Bar Codes   Benchmarking   Bitmaps   Bluetooth   Blur Effects   Bread Crumbs   BRMS   Browser Extensions   Build Systems   Bundles   Buttons   Caching   Camera   Canvas   Cards   Carousels   Changelog   Checkboxes   Cloud Storages   Color Analysis   Color Pickers   Colors   Comet/Push   Compass Sensors   Conferences   Content Providers   Continuous Integration   Crash Reports   Credit Cards   Credits   CSV   Curl/Flip   Data Binding   Data Generators   Data Structures   Database   Database Browsers   Date &   Debugging   Decompilers   Deep Links   Dependency Injections   Design   Design Patterns   Dex   Dialogs   Distributed Computing   Distribution Platforms   Download Managers   Drawables   Emoji   Emulators   EPUB   Equalizers &   Event Buses   Exception Handling   Face Recognition   Feedback &   File System   File/Directory   Fingerprint   Floating Action   Fonts   Forms   Fragments   FRP   FSM   Functional Programming   Gamepads   Games   Geocaching   Gestures   GIF   Glow Pad   Gradle Plugins   Graphics   Grid Views   Highlighting   HTML   HTTP Mocking   Icons   IDE   IDE Plugins   Image Croppers   Image Loaders   Image Pickers   Image Processing   Image Views   Instrumentation   Intents   Job Schedulers   JSON   Keyboard   Kotlin   Layouts   Library Demos   List View   List Views   Localization   Location   Lock Patterns   Logcat   Logging   Mails   Maps   Markdown   Mathematics   Maven Plugins   MBaaS   Media   Menus   Messaging   MIME   Mobile Web   Native Image   Navigation   NDK   Networking   NFC   NoSQL   Number Pickers   OAuth   Object Mocking   OCR Engines   OpenGL   ORM   Other Pickers   Parallax List   Parcelables   Particle Systems   Password Inputs   PDF   Permissions   Physics Engines   Platforms   Plugin Frameworks   Preferences   Progress Indicators   ProGuard   Properties   Protocol Buffer   Pull To   Purchases   Push/Pull   QR Codes   Quick Return   Radio Buttons   Range Bars   Ratings   Recycler Views   Resources   REST   Ripple Effects   RSS   Screenshots   Scripting   Scroll Views   SDK   Search Inputs   Security   Sensors   Services   Showcase Views   Signatures   Sliding Panels   Snackbars   SOAP   Social Networks   Spannable   Spinners   Splash Screens   SSH   Static Analysis   Status Bars   Styling   SVG   System   Tags   Task Managers   TDD &   Template Engines   Testing   Testing Tools   Text Formatting   Text Views   Text Watchers   Text-to   Toasts   Toolkits For   Tools   Tooltips   Trainings   TV   Twitter   Updaters   USB   User Stories   Utils   Validation   Video   View Adapters   View Pagers   Views   Watch Face   Wearable Data   Wearables   Weather   Web Tools   Web Views   WebRTC   WebSockets   Wheel Widgets   Wi-Fi   Widgets   Windows   Wizards   XML   XMPP   YAML   ZIP Codes