1

I lost my Android phone on vacation that was in airplane mode (Moto G5, v7 updated). It was protected by fingerprint and swipe. I almost always use the fingerprint to unlock, but do very occasionally use the swipe.

I locked it online remotely and remotely logged out of it when I realized it was lost several hours later. The timeout interval should be only 1 or 2 minutes.

I was hoping to recover it in some fashion, so I didn't remotely wipe it, secure in the knowledge that it couldn't be unlocked.

So I was surprised to be contacted two days (!) after I lost it on my other devices and accounts via an instant messaging app on the phone by someone who claimed to have found the phone and was looking for the owner.

In shock I didn't reply and quickly used Device Manager to remotely wipe the phone immediately. I also changed all my Google passwords for the accounts on the phone. I checked the Gmail logins and noticed none outside of my possession. I also checked Google Maps timeline and didn't see anything outside of my possession. Oddly, though, in Device Manager I clearly did see the phone located in the city I lost it, but a distance away from where I was.

A few questions:

  • How could a locked phone with a recent Android OS be unlocked, taken out of airplane mode, and home screen accessed?
  • How could the remote lock not work, assuming somehow someone opened up the phone within the lockout interval?
  • I saw the phone in the city I lost it on Device Manager (where I executed the remote wipe). How could it be there, but nowhere visible in my Google Maps timeline or Gmail login history?
  • Is there something I might be forgetting to do security wise?

Thank you.

  • Are you sure they used your IM account to text you? Could it be they just found your phone number on the lockscreen or notification and decided to text you using that? – harpratap Dec 29 '17 at 3:31
  • Yes, it was definitely an instant message from one of my IM accounts to a group I am part of that everybody received. It wasn't an IM from a person I didn't recognize. – bshor Dec 29 '17 at 3:55
  • What is the IM app you got the message through? – harpratap Dec 29 '17 at 4:05
  • It was Whatsapp – bshor Dec 29 '17 at 4:57
3

How could a locked phone with a recent Android OS be unlocked, taken out of airplane mode, and home screen accessed?

It wasn't. The person simply pulled out the sim card from your device, added into some other device and installed WhatsApp on it. WhatsApp doesn't have any login authentication, it will simply let anyone use it as long as they have access to sim card. This also explains why he/she could post in one your groups and not directly PM some contact (he/she doesn't have any of your contacts).

How could the remote lock not work, assuming somehow someone opened up the phone within the lockout interval?

Not possible in the 1-2 minute lockout interval you mentioned. Any kind of exploit will require at least few hours of work.

I saw the phone in the city I lost it on Device Manager (where I executed the remote wipe). How could it be there, but nowhere visible in my Google Maps timeline or Gmail login history?

Maps timeline isn't 100% accurate and up to date. Device Manager pings for real-time location. GMail login history shows only places where you actually logged in. You were already logged into your accounts when you went to that place, unless you didn't remove the account and added it back, it won't show login attempts in GMail.

I don't see any signs of breach in security of your device from the information you have provided.

  • If this is true, the op could reply to the message and hope that the person will answer – aBochur Dec 29 '17 at 5:36
  • Thank you for that answer. It makes the most sense to me. I decided to remotely wipe the phone just to be safe. It does seem like a glaring security hole to me for WhatsApp to have no authentication besides physical possession of a sim chip. All one needs is to pick it up, and you get access to my whatsapp chats?! – bshor Jan 14 '18 at 15:59
  • @bshor did you get your device back though? What happened after the person contacted you? – harpratap Jan 15 '18 at 2:34
  • @bshor WhatsApp does have an option for two step verification. WhatsApp>settings>account>two step verification. This will require apin besides for the phone number – aBochur Feb 1 '18 at 23:25
  • @harpratap No I never got it back ... :( About two step verification ... that makes sense. But I assume very few know about it ... like me. – bshor Feb 2 '18 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.