A week ago my professor's Pixel 4 XL was stolen from his desk when he left it there for charging. The phone has been shut down. It had few minutes of battery left when it was plugged in charging. Though I believe that the attacker has powered it off immediately and also turned off mobile data or turned on airplane mode which are unfortunately allowed in Pixel devices without unlocking the screen. I must say that this is a weak physical security design and helps the attacker more than environment safety*. Although location cannot be turned off at locked screen but it will be useless unless the device automatically reconnects to the nearby open wifi in campus to which the device was connected earlier.
I assured him that the data cannot be compromised because it is protected by file based encryption (FBE) which is bound to the user's lock screen password and lock screen password is verified by Titan M chip (TEE) to unlock the device. The attacker can still reset the device which is then prompted by factory reset protection when setting up the device. This is yet another weak physical security design because unauthorised factory reset can be prevented by adopting biometric authentication for bootloader and recovery mode by TEE which wakes up before the android bootloader is awaken.
In Pixel, bootloader can be unlocked by enabling OEM unlocking from developer tools and then executing fastboot flashing unlock in bootloader mode. As the attacker cannot reach developer settings without unlocking the screen, my professor asked if by using a hardware tool like UFS flash storage reader & writer, can the attacker directly tamper with OEM unlocking byte and bootloader state (locked & unlocked) bytes which are stored somewhere for persistence across reboots and flashing custom ROMs?
*Environment safety: Some security trade-offs were made by android security team by allowing to shut down, to turn on airplane mode and to turn off mobile data from locked screen so that devices in case of emergency like overheating of the device while in plane and radio interference, these features can be remain functional from locked screen.
