Security Bug in Samsung Galaxy S24: Bypassing Factory Reset Protection (FRP)

[abby_0820]

I recently encountered a concerning issue with my Samsung Galaxy S24. After forgetting my phone's password, I visited an authorized Samsung service center to perform a factory reset. Here's what happened:

1. The staff informed me that a factory reset would wipe all data and required server verification, for which I agreed and proceeded.
2. After the reset, to my surprise, the phone did not ask for Google or Samsung account verification.
3. The technicians themselves were shocked and said this was the first time they encountered such behavior. They were able to skip all set up your phone things without any intervention and handed the phone back to me.
4. They did not charge me due to this unusual situation.

This is a serious security concern, as Samsung devices are known for their secure hardware-backed encryption and Factory Reset Protection (FRP), which prevents unauthorized access post-reset.

If FRP can be bypassed in this manner, it raises questions about the reliability of security mechanisms on Samsung's flagship devices.

I urge Samsung to investigate this issue promptly to ensure the security of its users. If others have encountered similar issues, please share your experiences

#SamsungGalaxyS24 #FRPBug #SecurityIssue #FactoryReset #SamsungSupport

[Moiramon]

FRP is Google not Samsung.

[arianwen27]

Hey, factory reset protection is to protect after a device has been reset. It has never been to prevent a reset. You were correct from the start. When a device is reset improperly, on setup, it requires the owners Google account to setup. If a device was reset without unlocking it, the protection should be on for next setup. There has never been a system to prevent resetting the device. Maybe you didn't have Google find my phone on or maybe they actually did use a special tool to reset it, but it's very unusual for factory reset protection to not be there after a device was reset without being unlocked first.

From what I've seen on here, Samsung can bypass it if you prove ownership of the device. Though from what you've said, it seems like it just didn't enable for some reason

[Moiramon]

FRP is to stop unauthorized factory reset. If you sign out of your Google and Samsung account before resetting your phone then it will not ask for any password when setting it up.

[charzar85]

I either do not think you know what you are talking about, or you are not understanding exactly what buddy is referring to. What you are saying makes absolutely zero sense. Ok, so when you buy a new phone, this phone has a feature called "Factory Reset Protection". The moment you log into your Google account, you trigger this feature. How it works is really described in its title, if you pay attention (and not even much attention, it's three, or 3, words)...FACTORY RESET, and PROTECTION. (I'll clarify I'm not yelling, it's to emphasize.) It literally is to protect your data, and to attempt to protect your device from being operational after an illegitimate factory reset. An example of an illegitimate factory reset would be using hardware heys to enter recovery mode and resetting the device from the recovery. If you are logged into your device and use the settings app to reset your device it will not trigger the lock, as long as you remove the Google account first. But then you have to verify the screen lock pin, pattern or biometric security in order to remove the final Google account on the device. So, and pay attention because in about to tell you why you are wrong in what you're saying...if you RESET the phone, of course it deletes everything. However the FRP lock absolutely will NOT simply allow you to set up as a new device, not unless you can provide the Google credentials that were logged into on the device when it was illegitimately factory reset. This is because typically if the owner of the phone reset it, odds are the owner a) would have reset through settings following the proper procedure and b) worst case scenario he had no choice but to reset via recovery due to a software glitch or whatever, he would more than likely remember his screen lock pin/pattern or his Google account credentials in order to resign into his phone. If you can't provide any of these, Google will give you an opportunity to prove who you are by asking 2 questions; your phone number and your name (just a first name, the last name is optional. I swear Google did that as a big middle finger to the thief trying hard to access the device 😂) and I mean, if this IS your phone and you got hit in the head hard enough to forget your credentials and screen lock code, you SHOULD know your name at least, and ask your buddy for your digits...either way, if you STILL can not even provide that, Google will tell you to kick rocks. And guess what? You WILL NOT be able to set up, not until you provide the previous credentials. Period. I don't care what you try and say to counter what I just said, I KNOW what I'm talking about because I bypass them on a daily basis. But I'm a tech/developer, I have access to tools you don't have access to. But I also never unlock without proof of ownership. Occasionally there are legitimate reasons for the FRP lock being triggered. But 9 times out of 10, there's only one reason...the phone is stolen. A good thing to do if it's FRP locked is check imei for blacklist status. A stolen phone will be reported by the Carrier if its on a plan, or if a pay and talk phone is bought by the dealer and not brought in yourself. And most people know this shop if its a prepaid phone, people usually keep record of their I me I do if it gets stolen, they can blacklist it. Do not get caught with a blacklisted phone. You will most likely be charged, and if you have a criminal record already, you might just earn 3 hots and a cot for a period of time. Flagship phones are selling for as much as a staggering $1800 (DOL), it's serious sh*to top steal them, and no they will never make it as easy as you claim. Ever. You say you've done it and I 100% believe you....but only before Android 5. If you tell me you've simply reset an FRP locked phone and it just let you setup with no qualms post-Android 5, I will honestly go you a liar. No offense. Have a good day, and don't spread false information 

[-Robot-]

I am not wrong, feel free to contact support and verify what I have said

It's you who don't know what your on about, also black isted phones don't work in the country it is registed in, hence stolen phones are sold overseas where the black list doesn't exist.

The factory reset was carried out by a Samsung service service center so they are about to completely factory reset the handset hence the original poster said. Also you don't know if the factory reset protection state

You should read the original post instead of calling people names

False information is the information you provided by you

[charzar85]

I did read it "Robot"......The service center performed a normal factory reset, normal before they proceed with the rest of the process. They were surprised to find that after a normal hard-key factory reset that there was no prompt to enter previous credentials. The Samsung service professionals themselves were baffled as to why, when they then handed back the phone with zero cost to the OP because they didn't have to do anything saying to the OP that they had never seen anything like that. Did YOU read? It appears everybody thinks that's weird, except for you. You're arguing that it's normal because the service center reset it. But here's the thing dude, yes the phone was in the rep's hand when performing a hard reset (through recovery, no doubt..if OP was locked out, would be the only way to factory reset it), but all he did was the factory reset from recovery mode....the same reset that triggers factory reset protection lock...but it didn't get triggered and THAT'S WHAT OP IS TALKING ABOUT! You blast me like I didn't read yet you literally are saying the service center did something that the OP said in his post that they had NOT done yet because they didn't have to! That's called making up details to fit whatever you're trying to say dude..or bot, whichever....how are you not seeing this.. Point form..

-OP goes to service center to bypass FRP 

-Service reps informs that this will reset all data, asks if that's cool, OP agrees. 

-Service rep (undoubtedly phone can't be accessed so rep uses vol+ and power to access recovery. A hard reset) performs factory reset

-Service rep is astonished that FRP didn't trigger, realized due to fact that Google credentials are not required and he is able to skip all Android setup to the home screen

-Service rep hands phone back to OP, unable to charge anything since he didn't DO anything. 

What do you not get about that? That is not normal, you cannot simply reset a phone and expect the reset to let you in because "it's not protecting data anymore so it did its job and blah, blah, blah..." the frp DOES in fact attempt to make the phone useless to a thief by way of making it inoperable if you can't enter the credentials. Stop arguing man. And no, I'm not spreading misinformation buds, but you certainly are. I don't NEED to verify what you're saying here, because nobody would. It's simply not the case. I truly can't see how you're not understanding this...🤯...that, that's my blown mind. Your fault lol. I know what I'm talking about, I read his post and all your comments...I'm not talking out my ass dude, you are though. And watching you try to argue back, it's quite funny. I only argue when I KNOW...beyond a single doubt that what I'm saying is correct. And it is. I'm done discussing this with you because you simply will keep going on and on like you know what you're talking about. Don't reply to me anymore and make me have to block you. I refuse to argue with a closed-minded "robot". Bye

[-Robot-]

Firstly their tools too factory reset handset that wipe any locks, developed by Samsung for their engineers, second we don't know the state of the frp

So do tell me, I don't know what I am talking about.

[charzar85]

It says right in the original post that the service rep didn't be too use any friggin tools! It says right in the post that he merely performed a regular factory reset in the palms of his hands, and that he was surprised to see that the phone didn't ask for credentials after! Are you kidding me right now? You're just an internet troll dude, just trying to ***** people off. I WILL 100% say you do not know what you're talking about, because you clearly do not. That or you can't read what the original post says, or how many times I've told you now what the original post says. Just stop, stop trolling man, wtf do you get out of it? Because if you want the truth, you're honestly just making yourself look very uneducated right now. And I'm done paying any attention to your idiocy

[-Robot-]

You obviously telling about yourself.

We don't know what was performed on the handset but they have the tools to do it. If they reset it then is possibility they did do it.

As opposed to your post when you said it wasn't possible.

I suggest you stop being rude and calling people names or I will be the one reporting you

[charzar85]

You suggest? Dude, 

You.......are.......wrong.........what do you not get about that? I said stop and you won't. Saying you're trolling is the truth. Sorry you can't handle that. Just stop dude, seriously