Forgot your password?
typodupeerror
Cellphones Privacy Android Media Security

Avast Buys 20 Used Phones, Recovers 40,000 Deleted Photos 231

Posted by Soulskill
from the delete-then-rewrite-then-smash-into-bits dept.
An anonymous reader writes: The used smartphone market is thriving, with many people selling their old devices on eBay or craigslist when it's time to upgrade. Unfortunately, it seems most people are really bad at wiping their phone of personal data before passing it on to a stranger. Antivirus company Avast bought 20 used Android phones off eBay, and used some basic data recovery software to reconstruct deleted files. From just those 20 phones, they pulled over 40,000 photographs, including 1,500 family pictures of children and over a thousand more.. personal pictures. They also recovered hundreds of emails and text messages, over a thousand Google searches, a completed loan application, and identity information for four of the previous owners. Only one of the phones had security software installed on it, but that phone turned out to provide the most information of all: "Hackers at Avast were able to identify the previous owner, access his Facebook page, plot his previous whereabouts through GPS coordinates, and find the names and numbers of more than a dozen of his closest contacts. What's more, the company discovered a lot about this guy's penchant for kink and a completed copy of a Sexual Harassment course — hopefully a preventative measure."
This discussion has been archived. No new comments can be posted.

Avast Buys 20 Used Phones, Recovers 40,000 Deleted Photos

Comments Filter:
  • by PC_THE_GREAT (893738) on Wednesday July 09, 2014 @12:31AM (#47412807)
    When someone says reset phone and reset data, the OS should ensure a clean wipe not a soft wipe. Should atleast fill it with 0s. And people should try to keep most of their data on sd cards and move those alongs when they get new phones.

    What kind of people sell sd cards along with phone. I thought everyone are misers.

    Am tempted to know what kind of nudie pics where available :p.
    • But how many people actually reset phone and reset data? I'd imagine a lot of people simply manually delete their photos and unhook their Internet accounts from the phone. Hardly a wipe.

      • by tlhIngan (30335) <(ten.frow) (ta) (todhsals)> on Wednesday July 09, 2014 @01:22AM (#47413007)

        But how many people actually reset phone and reset data? I'd imagine a lot of people simply manually delete their photos and unhook their Internet accounts from the phone. Hardly a wipe.

        But it's so easy to do on iOS. You can do it on the phone - Settings->General->Reset

        And it wipes the phone - the flash storage is encrypted. Resetting it wipes the key and generates a new one. It then reboots and reformats the user storage using the new key and mounts it. The old data is irrecoverable because the key is lost, and the new data is written using a new key.

        Even prior to encrypted storage, iOS3 created the option to do it where it erases and wipes the storage - anything 3GS and newer wipes keys (so wiping takes a couple of minutes), older ones took a couple of hours.

        No reason Android can't do the same - either by sending TRIM commands to the entire user storage area and then forcing a write-all-with-zeroes to be doubly sure.

        • by MyFirstNameIsPaul (1552283) <myfirstnameispaul@gmail.com> on Wednesday July 09, 2014 @02:30AM (#47413199) Homepage Journal
          I would not trust an encryption method as a replacement for permanent data destruction, but I may be more paranoid than most.
          • by itsme1234 (199680)

            Well how are you using the phone otherwise? Do you keep it locked in some booby-trapped safe? Otherwise you can still lose it and it'll be in a much worse shape than it is when you sell it with keys wiped and storage formatted (even if technically not fully wiped even if still encrypted). It might be unlock-able, it might have some SD-card you regularly keep in it (but you wouldn't leave there if you sell the phone). etc.

            • by Razed By TV (730353) on Wednesday July 09, 2014 @08:06AM (#47414077)
              I think you're looking at it from the wrong angle. For general purpose phone use, encryption is reasonable. But for the purposes of permanent deletion, why rely on encryption when you could just shred the data and be done with it once and for all?
              • by BasilBrush (643681) on Wednesday July 09, 2014 @09:24AM (#47414471)

                Because throwing the keys away on an encrypted drive is more secure than overwriting an unencrypted drive with zeros, as the data recovery experts will be glad to tell you.

                • by vux984 (928602)

                  Because throwing the keys away on an encrypted drive is more secure than overwriting an unencrypted drive with zeros, as the data recovery experts will be glad to tell you.

                  But that's a false choice. There is a 3rd option... do both.

                  Take your most private information, encrypt it, and put it on a flash drive.

                  Then go and sell or give that flash drive away to someone else.

                  Are you really going to say... well they don't have the keys, so we're good. Here you go. And hand them all your data intact (but encrypted).

            • by Lumpy (12016)

              He has a special edition otterbox case that is filled with C4 explosives. if the phone gets more than 6 feet from him it detonates. sadly he goes through about 40 phones a year.

          • I would not trust an encryption method as a replacement for permanent data destruction, but I may be more paranoid than most.

            More paranoid than computer scientists, for sure.

          • Settings / Security / Encrypt Phone - I've never used it, but I am assuming it encrypts everything under /data.
          • I understand that a format of /data is what happens behind the factory reset option. Using GNU shred on the device file for this filesystem might prevent any recovery.
        • by Pax681 (1002592)

          But how many people actually reset phone and reset data? I'd imagine a lot of people simply manually delete their photos and unhook their Internet accounts from the phone. Hardly a wipe.

          But it's so easy to do on iOS. You can do it on the phone - Settings->General->Reset

          And it wipes the phone - the flash storage is encrypted. Resetting it wipes the key and generates a new one. It then reboots and reformats the user storage using the new key and mounts it. The old data is irrecoverable because the key is lost, and the new data is written using a new key.

          Even prior to encrypted storage, iOS3 created the option to do it where it erases and wipes the storage - anything 3GS and newer wipes keys (so wiping takes a couple of minutes), older ones took a couple of hours.

          No reason Android can't do the same - either by sending TRIM commands to the entire user storage area and then forcing a write-all-with-zeroes to be doubly sure.

          Android CAN do the same by simply performing a factory reset.. apple hardly had a fucking monopoly on factory reset functions in phones.
          it's just that most normal users haven't a fucking clue and thus don't reset their phones to factory state and that's where the problem lies.

          • With iOS, it's a simple option to securely delete everything. And it takes no time.

            With Android it's not a one step operation and it's full of ifs and buts. And it will take some time. See for example:

            http://lifehacker.com/5808280/... [lifehacker.com]

            • by Pax681 (1002592)
              sorry but bugger apple, bugger their walled garden and the boat they came in on.
              i am very happy with my S5 thanks, and was happy with my S3,S2 and my htc desire before that.
              • Your personal phone preferences are irrelevant. This is a discussion of a specific feature of iOS and a weakness of Android.

                • by Pax681 (1002592)

                  Your personal phone preferences are irrelevant. This is a discussion of a specific feature of iOS and a weakness of Android.

                  it must've really made you weed when the saviour.. the lord jobs kacked it eh? i bet you wept onto your wee i-devices.... shame that's not covered under waranty eh? LOL.
                  however it's hilariously funnyh that MY preference and experience with android devices somehow negates what i say but your blatant fucking fanboism driven bollocks is fine?
                  now THAT is fucking funny :)

          • by jandrese (485)
            Uh, the factory reset doesn't wipe the storage on the phone. These phones that were bought off of eBay were probably factory wiped (people aren't quite as dumb as advertised), but the issue is that Factory Wipe doesn't do what people think it does.
            • True, it doesn't, but it does delete the key which is used to encrypt everything. With no key, it's gibberish, indistinguishable from random data. Or so claims Apple, anyway. If you have better data, I'd be most interested to see it (and freely admit it's possible ANY vendor is lying about their security precautions).

              Personally, I find it quite possible that Joe RandomUser would "delete" pictures, etc, and not know how to do a proper wipe. Heck, I had to look it up, but it took knowing that in general "

      • "resetting" your phone to manufacturer settings doesn't wipe any data. Even manually "deleting" it and then "resetting" the phone doesn't do that. It merely marks the flash memory in the phone to be "reusable".

        The only way to make sure the data is gone is to fill the phone up with garbage data after you've done a factory reset so there is something else written to the flash memory. After you've filled it up to the last bit, do another factory reset and you will be as close as you can get without destroyin

        • by dbraden (214956)

          But you wouldn't need to re-write all of the flash memory if it is encrypted and the key is properly wiped. Without the key it might as well be random data. The trick would be to make sure that the original key isn't still lurking on one of the chips, but I'd like to think that people far smarter than me worked that part out.

          • that you knew enough to wipe those copies of the keys yourself. I mean, EVERYONE knows that key lives in that directory right? Anyone who really CARED about the product would know enough to learn about it.

    • by gnasher719 (869701) on Wednesday July 09, 2014 @03:16AM (#47413363)

      When someone says reset phone and reset data, the OS should ensure a clean wipe not a soft wipe. Should atleast fill it with 0s. And people should try to keep most of their data on sd cards and move those alongs when they get new phones.

      There's one phone that just throws away the encryption keys, which are never stored anywhere than on two locations on the hard drive (in encrypted form), so only these two locations need to be wiped. That phone also has the ability to access a small amount of flash memory directly without the firmware interfering, to make sure that no invisible copies of those keys are created. Well, it's not Android...

    • by Lumpy (12016)

      It does if you enable security and turn on locking. Betting all those phones never had a lock pin so the data was held in flash without any encryption.

    • Too bad most phones no longer have micro-SD slots.
  • by SeaFox (739806) on Wednesday July 09, 2014 @12:32AM (#47412811)

    Unfortunately, it seems most people are really bad at wiping their phone of personal data before passing it on to a stranger.

    How many people actually have the ability to securely wipe data on their phone to start with, without rooting it? For lots of folks, the "factory reset" option is the only thing they can do on their own, and that likely only deletes prefs and network settings and erases file system directory info. It does not overwrite the bits in the phone's storage to make them unrecoverable.

    • by Mr0bvious (968303) on Wednesday July 09, 2014 @12:41AM (#47412851)

      As stated above this really should be an inbuilt OS feature - "Reset for resale"

      It shouldn't take an understanding or knowledge of the intricacies of how the device works or how to properly erase data. It should be automatically done by the OS since most phone users do not know how to do it properly.

    • I can go in to the settings menu and select encrypt device.
      Not sure if that's new for Android 4.4 or if it came earlier.

  • Only Android? (Score:4, Interesting)

    by exomondo (1725132) on Wednesday July 09, 2014 @12:34AM (#47412825)
    Does the same thing occur with iPhones or Windows Phones or Blackberrys?
    • by friedmud (512466)

      If you don't wipe your phone this can happen with anything (including an iPhone)...

      However, if you reset an iPhone there is NO way to recover anything. Everything written on an iPhone is encrypted... when you reset an iPhone it securely wipes the key and then nothing is retrievable.

      • Re:Only Android? (Score:4, Insightful)

        by exomondo (1725132) on Wednesday July 09, 2014 @12:58AM (#47412923)
        They don't mention if any of the devices were using Android's full device encryption either or which of the devices they recovered deleted data from rather than just receiving a phone where the user had forgotten to delete their data. Seems less like a study and more like a sales pitch.
        • Reading between the lines, the data was recovered with recovery tools, because standard delete on a flash drive just marks a block as reusable, it doesn't actually overwrite the data.

      • by Lumpy (12016)

        Except for all of the copies in the iCloud.

        • Indeed, you do have all the data on iCloud still safe. It's not on the phone though, and neither is any username or password, so it's irrelevant to selling the phone.

  • Factory reset. (Score:5, Interesting)

    by bejiitas_wrath (825021) <johncartwright302@gmail.com> on Wednesday July 09, 2014 @12:52AM (#47412899) Homepage Journal

    So taking out the SD card and a factory reset is not enough anymore? But how do you run DOD quality data wiping software on a phones built-in memory anyway? Most people hock phones and they are re-sold with phone numbers still on them. That should not happen. Let alone personal photos.

    • by glitch! (57276)

      Five to ten seconds in a microwave oven should do the trick. A good physical smashing is probably effective. Or just bury the damn thing. But don't sell it and have any expectation of privacy.

    • Although the factory reset option hands the request off to the recovery partition after a reboot, so clockworkmod or the equivalent would be responsible for making this happen.
  • by itsme1234 (199680) on Wednesday July 09, 2014 @01:00AM (#47412933)

    Yes, most devices we use don't actually wipe the data when you "reset to factory settings". Even desktop OSes don't do it (either by default, either at all, need special tools, etc). I bet this feature is really low on the "to do" list for most manufacturers of not only phones but also wifi routers, TVs, wireless cameras, you name it. We didn't (or maybe barely) manage to educate them not to put trivial backdoors, secure wipe is a long way out.

    • by AmiMoJo (196126) *

      Samsung market their secure wipe software as a feature, so apparently there is market demand for it.

      • by itsme1234 (199680)

        Funny thing is that they messed up the command(s) to the flash memory and created a super-brick bug that would terminate your phone if the great "wipe" feature was used (for reference google MMC_CAP_ERASE).

      • Be careful not to confuse marketing with demand.
  • by Vellmont (569020) on Wednesday July 09, 2014 @01:12AM (#47412969)

    Why do we still talk like we're in middle school? Why the code talking? "personal pictures", "manhood"? Can't we just say they found pictures of guys penises, and nude to semi-nude women?

    People take nude photos of themselves, don't realize it's still on the phone, and sell the thing. The fault lies with the cell phone makers who aren't actually doing real deletes of pictures. That's just dumb. Back when storage medium was on a hard drive, and computers do a LOT of IO, deleting the reference to the file made sense to improve performance. But all phones use flash as storage, and there's simply not a lot of IO that's going on in your typical phone usage. The OS should be wiping the file, or at the very least remove the reference, and wipe the file at a later (but soon) time after (like perhaps while the user is typing something and is otherwise idle).

    The reality is phones get stolen, and the data is far less secure than on a PC. The OS needs to keep up with that. Deleting data for good should mean actually deleting the data. The shortcuts that've been done in the past should be a thing of the past.

    • by worf_mo (193770)

      I thought there was a certain discrepancy between their middle school talk about manhood and their using the Goatse guy symbol in the green infochart (bottom right, above the "male nude selfies")...

    • by AmiMoJo (196126) *

      All those erase cycles would wear out the flash memory much faster. Flash can generally only erase blocks, so to remove part of a block the entire thing has to be read, erased and re-written.

      The simple solution is just to enable encryption. Android has supported it for years. Then a wipe destroys the key, and all the data is gone.

      • by Vellmont (569020)


        All those erase cycles would wear out the flash memory much faster.

        The wear limits, and wear leveling on flash memory are such that even with heavy usage you'd still outlive the lifetime of the phone by an order of magnitude at least. (on the order of 1,000,000 erases). A phone is never even going to approach heavy usage. So I reject the idea that we can't erase because it'll wear out the flash memory prematurely.

    • Avast is a corporation. Corporations tend to be conservative in their use of language (outside of the porn industry, at least). Using the term "penis" in a press release isn't going to happen.

  • by mendax (114116) on Wednesday July 09, 2014 @01:21AM (#47413005)

    This article is good reading in itself but it wound up being an advert for the poster's product. I wonder how much Dice got paid to post this "story"? Is it any wonder I spend more time over at soylentnews.org, the name of which I was going to bury in a link but couldn't because the link gets replaced with "slashdot.org"?

  • Who fills out a loan application on a phone? That has got to be the most painful web experience ever!
  • By the time it is old it is worthless. Just smash it up and throw it in the river.

    • By the time it is old it is worthless. Just smash it up and throw it in the river.

      Because, when I am done with it, it is essentially an wifi enabled mp3 player with browser that I can take and use in situations where I might fear getting my new phone broke, lost, or wet.

  • by marcello_dl (667940) on Wednesday July 09, 2014 @04:09AM (#47413485) Homepage Journal

    They have circumvented a protection measure, that is wiping the phone- a faulty protection measure, but that doesn't matter, as history taught us if you find holes and publicize them, no matter the responsibility of the manufacturer, you are terrorist!

    Moreover, it is clear they have an interest in selling their own protection products, and that they have given bad ideas to people who normally would have started using the second hand phone and overwriting the crap with their own crap.

    So why doesn't avast end up in trouble like $RANDOM_HACKER ? Huh?

  • I was wondering why someone would buy 20 crappy phones from me on eBay.

    Just kidding. I take all my dirty pictures with a Polaroid. :)

  • by JDG1980 (2438906) on Wednesday July 09, 2014 @07:28AM (#47413951)

    How is this not a violation of the Computer Fraud and Abuse Act (CFAA)? They bypassed security measures (deletion) to access someone else's personal information without authorization. Given how broadly this has been interpreted in the past (Andrew Auernheimer was prosecuted for visiting public URLs on the Internet), Avast's act clearly should be considered a violation. Or is this a case of "if a corporation does it, it is not illegal"?

    • I'd say it deserves whistleblower protection. But in this country no one in power wants to hear from whistleblowers. When whistleblowing is illegal, only criminals know anything.
  • Simple (only tens of thousands of lines code needed, hehheh). You program a Full Secure Erase feature in the phone. It wipes all personal data, resets all the settings, removes user-installed apps, deletes caches and erases the memory card. All the jazz. Filling with zeroes is used where appropriate. Then the phone is put into OOBE (out-of-box experience) mode, which means that on next startup it says "Hey, I see you are using the phone for the first time, let's set up a couple of things."

    Make this a de-fac

You can measure a programmer's perspective by noting his attitude on the continuing viability of FORTRAN. -- Alan Perlis

Working...