A Security flaw has been found in Android 5.x <= 5.1.1 (before build LMY48M) that allows an attacker to crash the lockscreen and gain full access to a locked device, even if encryption is enabled on the device.
According to the researchers, the attacker gains the access by manipulating a sufficiently large string in the password field when the camera app is active an attacker is able to destabilize the lockscreen, causing it to crash to the home screen.
At this point arbitrary applications can be run or adb developer access can be enabled to gain full access to the device and expose any data contained therein.
It is only possible when the attack must have physical access to the device. So, Android users must set password either pin or pattern.
The researchers have suggested that in order to breakdown the attack, the users should open the EMERGENCY CALL window from the locked screen. Type a few characters like 10 asterisks. Then, double-tap the characters to highlight them and copy the buttons. Then tap once in the field and tap paste, doubling the characters in the field. Repeat this process of highlight all, copy, and paste until the field is so long that double-tapping no longer highlights the field. This usually occurs after 11 or so repetitions.
