T1629.002 Device Lockout

T1629.002 Device Lockout

Sub-technique of: T1629

High-Level Description

An adversary may seek to inhibit user interaction by locking the legitimate user out of the device. This is typically accomplished by requesting device administrator permissions and then locking the screen using DevicePolicyManager.lockNow(). Other novel techniques for locking the user out of the device have been observed, such as showing a persistent overlay, using carefully crafted “call” notification screens, and locking HTML pages in the foreground. These techniques can be very difficult to get around, and typically require booting the device into safe mode to uninstall the malware.

Prior to Android 7, device administrators were able to reset the device lock passcode to prevent the user from unlocking the device. The release of Android 7 introduced updates that only allow device or profile owners (e.g. MDMs) to reset the device’s passcode.

Kill Chain Phase

• Defense Evasion (TA0030)

Platforms: Android

What to Check

• Identify if Device Lockout technique is applicable to target mobile environment
• Check Android devices for indicators of Device Lockout
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Identify Attack Surface

Determine if the target mobile environment is susceptible to Device Lockout by examining the target platforms (Android).

Assess Existing Defenses

Review whether mitigations for T1629.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Remediation Guide

M1006 Use Recent OS Version

Recent versions of Android modified how device administrator applications are uninstalled, making it easier for the user to remove them. Android 7 introduced updates that revoke standard device administrators’ ability to reset the device’s passcode.

Detection