PIN bypass

How it was found

Summary:

MEW apk has improper rate limit.

When we try to brute force the PIN, we are rate limited for 5 minutes after 5 or 6 attempt.

In my testing I found that it was checking the device's local time so by changing it we can brute force the PIN.

Steps To Reproduce:

1.Install MEW app from play store.

2.Create your PIN.

3.Now open again your MEW apk.

4.You will be asked to enter the PIN.

5.Try to brute force the code. You will see a message to try again after 5 min.

6.Now change the time of your device.

7.Observe there is no rate limit now.

Supporting Material/References:

{F1350023}

Impact

An attacker can brute force the PIN of an user