A new version of a forensic tool, released on 1 July, decrypts the Samsung Galaxy S20. It does not need a police supercomputer. It runs on a gaming graphics card, the kind you would put in a gaming PC, worth around 900 euros.
The tool is Passware Kit Mobile, and what version 2026 v4 adds is the Qualcomm-based Samsung S20, S20+ and S20 Ultra, the early-2020 models. The phone's encryption was not broken. What fell was the wall that limited how many times someone could try to guess your code. Once that wall is gone, the length of your secret is the only thing between a stranger and everything on your phone.
They did not break the cipher, they tore down the wall
The method exploits a startup flaw carved into the chip's own silicon, known as the bootrom. It is a distinction that changes everything: a software flaw is fixed with an update, a flaw etched into the chip stays there forever. No Android update closes it, because the problem sits beneath the system.
With the wall down, it becomes cold arithmetic. On a Galaxy S20, Passware says it tests more than 17,000 codes per second with an ordinary graphics card. At that rate, a four-digit PIN, which has ten thousand combinations, falls in under a second. Six digits are a million combinations and last about a minute. A real password, longer and made of random letters and numbers, would take years or centuries. That is the whole game, and almost everyone enters it with four digits.
There is a caveat in favour of newer phones: in them, that wall no longer lives in the startup code, it moved to a dedicated security chip, kept apart. So what opens a 2020 model does not simply open a current flagship. You buy time, not a guarantee.
Even so, the direction is always the same. The maker says that, added to what it already did with the S10 and the Exynos-based S20, it now has "full coverage" of both Samsung lines. The same version added the iPhone 6S and other older Apple models, Huawei phones and several Android devices. Forensic capability is cumulative: what resists today joins the list tomorrow, and the list only grows.
In Portugal, this has an address
This is not a scenario from somewhere else. In October 2024, Portugal's Judicial Police opened a Digital Forensics Laboratory with an investment of nearly seven million euros, built precisely to extract and analyse data from seized devices. Tools like this one are what feed labs like that, here and everywhere.
There is a legal limit in your favour, and it is worth knowing. In Portugal no one can force you to reveal your password; the Cybercrime Law itself bars ordering a suspect to hand over the data. Unlocking with your face or your fingerprint is more disputed ground, but the prevailing reading extends the same protection to it. Notice, though, what the law actually blocks: the duty to cooperate, not the authorities' right to try to open the phone by their own means. That is exactly what a lab like the Judicial Police's is for.
How to make your secret expensive
The defence is yours to set, and it is a secret that will not fit inside a minute of computation:
- Swap the PIN for a phrase. A password of eight or more characters, with upper and lower case and numbers chosen at random, turns the arithmetic from seconds into centuries. It is the single move that protects you most, and the easiest. A dictionary word or a date does not count; it falls all the same.
- Treat biometrics as convenience, not as a vault. Useful day to day, but learn the shortcut that disables it and demands the code again when the risk rises.
- If the situation is serious, restart or switch the phone off. Powered down and not yet unlocked, the data sits in the state most resistant to extraction.
- Do not keep the irreplaceable only there. What you cannot lose should also live elsewhere, encrypted, with two-factor authentication and a password different from your phone's.
Encryption was never a vault, it was a stopwatch. What you decide is how long it counts before it hits zero, and four digits count for almost nothing. A phone from 2020, one everybody thought was safe, fell in 2026 within reach of a gaming card. Today's phones last longer, but the list only moves forward, never back.
Source: Forensic Focus.
#StaySafe
🙏🖖
