Security warning over Android phone reset systems
Security experts have passed a warning that using the “factory reset” option to wipe Android phones may leave behind valuable data. Report from Cambridge University researchers provides that the reset function may also fall short when used to remotely wipe a phone that has been lost or stolen.
The researchers bought used Android phones to see the sort of data that remained on the phones for their analysis. In some cases they retrieved key files that let them access a former owner’s Gmail account. The study of 21 phones running Android versions 2.3 to 4.3 was carried out by Prof Ross Anderson and Laurent Simon from the University of Cambridge computer science department.
From the research they found flaws that could mean that up to 500 million Android devices might be at risk of leaving data available to attackers after being reset. The researchers warned in a blogpost. “ These failings mean that staff at firms which handles lots of second-hand phones whether stolen, lost, sold or given to charity could launch some truly industrial-scale attacks.” They said.
All the phones analyzed left some data behind after a factory reset. In most of the phones tested data generated by apps for WhatsApp and Facebook was left behind. In addition images, videos and text messages were also recoverable. In 80% of the Android handsets the researchers managed to get at an important file known as the “master token” that is used by Android to give a phone access to Google services such as Gmail.
The researchers said that attacks on a sold phone that could not be properly sanitized are one example of what they call a “user-not-present” attack. Another is when your phone is stolen. Many security software vendors offer a facility to lock or wipe your phone remotely when this happens and its standard feature with mobile antivirus products.
The reasons for the failings were complex, said the researchers, but some came about because of the way that phone memory is made and because software to make sure data was deleted had not been updated. Google declined to comment on the findings. The firm introduced changes with several android versions to make reset more thorough. Android 3.0 brought in an improved erasing mechanism to prevent data from being retrieved.
Updates to the reset system have also been brought in with Android 5.1 that was released earlier this year. Many phones now use encryption to scramble data so it cannot be read even if it is retrieved. However, the Cambridge researchers found that on some phones, other files they could retrieve helped to get at this scrambled data.