{"action":"created","issue":{"url":"https://api.github.com/repos/Maxr1998/MaxLock/issues/36","labels_url":"https://api.github.com/repos/Maxr1998/MaxLock/issues/36/labels{/name}","comments_url":"https://api.github.com/repos/Maxr1998/MaxLock/issues/36/comments","events_url":"https://api.github.com/repos/Maxr1998/MaxLock/issues/36/events","html_url":"https://github.com/Maxr1998/MaxLock/issues/36","id":81204529,"number":36,"title":"\"Device Administrators\" screen is not protected after getting into settings ","user":{"login":"BoringUserWhoCantCode","id":8726042,"avatar_url":"https://avatars.githubusercontent.com/u/8726042?v=3","gravatar_id":"","url":"https://api.github.com/users/BoringUserWhoCantCode","html_url":"https://github.com/BoringUserWhoCantCode","followers_url":"https://api.github.com/users/BoringUserWhoCantCode/followers","following_url":"https://api.github.com/users/BoringUserWhoCantCode/following{/other_user}","gists_url":"https://api.github.com/users/BoringUserWhoCantCode/gists{/gist_id}","starred_url":"https://api.github.com/users/BoringUserWhoCantCode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BoringUserWhoCantCode/subscriptions","organizations_url":"https://api.github.com/users/BoringUserWhoCantCode/orgs","repos_url":"https://api.github.com/users/BoringUserWhoCantCode/repos","events_url":"https://api.github.com/users/BoringUserWhoCantCode/events{/privacy}","received_events_url":"https://api.github.com/users/BoringUserWhoCantCode/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-27T00:47:03Z","updated_at":"2015-05-27T01:40:09Z","closed_at":null,"body":"I don't want to protect settings to not draw attention. Yet, I feel a Fake Die screen when trying to disable the app in Device Administrators is very important. An intruder should be thinking that the Device Administrator is broken and force closing, not that I'm locking any apps."},"comment":{"url":"https://api.github.com/repos/Maxr1998/MaxLock/issues/comments/105715859","html_url":"https://github.com/Maxr1998/MaxLock/issues/36#issuecomment-105715859","issue_url":"https://api.github.com/repos/Maxr1998/MaxLock/issues/36","id":105715859,"user":{"login":"BoringUserWhoCantCode","id":8726042,"avatar_url":"https://avatars.githubusercontent.com/u/8726042?v=3","gravatar_id":"","url":"https://api.github.com/users/BoringUserWhoCantCode","html_url":"https://github.com/BoringUserWhoCantCode","followers_url":"https://api.github.com/users/BoringUserWhoCantCode/followers","following_url":"https://api.github.com/users/BoringUserWhoCantCode/following{/other_user}","gists_url":"https://api.github.com/users/BoringUserWhoCantCode/gists{/gist_id}","starred_url":"https://api.github.com/users/BoringUserWhoCantCode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BoringUserWhoCantCode/subscriptions","organizations_url":"https://api.github.com/users/BoringUserWhoCantCode/orgs","repos_url":"https://api.github.com/users/BoringUserWhoCantCode/repos","events_url":"https://api.github.com/users/BoringUserWhoCantCode/events{/privacy}","received_events_url":"https://api.github.com/users/BoringUserWhoCantCode/received_events","type":"User","site_admin":false},"created_at":"2015-05-27T01:40:09Z","updated_at":"2015-05-27T01:40:09Z","body":"Actually, I figured if out by using \"activities\". But there's a bug/security vuln; reproduce:\r\n\r\nWhen you protect Device Admin activities (there are three to check), go to device admin settings, try to disable MaxLock from being an Admin, *you'll be presented with MaxLock Fake Die*, just click OK (not the secret \"report\") and it's disabled... Not Admin anymore.\r\nNow install some uninstaller from the market (since the package installer is locked and we can't use it) and you'll be able to uninstall MaxLock.\r\n\r\nTo mitigate, add option to install MaxLock as a system app. I'll be trying this using Titanium Backup. I assume it'll work, if it didn't, I'll post why it didn't. (So if I don't ever see you again, it worked). ;)"}}