Flaws found in Android "factory reset" data wiping procedures
(Univ. of Cambridge): http://www.cl.cam.ac.uk/~rja14/Papers/fr_most15.pdf
With hundreds of millions of devices expected to be traded by
2018, flaws in smartphone sanitisation functions could be a serious
problem. Trade press reports have already raised doubts about the
effectiveness of Android "Factory Reset", but this paper presents the
first comprehensive study of the issue. We study the implementation of
Factory Reset on 21 Android smartphones from 5 vendors running Android
versions v2.3.x to v4.3. We estimate that up to 500 million devices
may not properly sanitise their data partition where credentials and
other sensitive data are stored, and up to 630M may not properly
sanitise the internal SD card where multimedia files are generally
saved. We found we could recover Google credentials on all devices
presenting a flawed Factory Reset. Full-disk encryption has the
potential to mitigate the problem, but we found that a flawed Factory
Reset leaves behind enough data for the encryption key to be
recovered. We discuss practical improvements for Google and vendors to
mitigate these risks in the future.
- - -
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
