Factory Reset On Millions of Android Devices Doesn't Wipe Storage 92
Bismillah writes: Ross Anderson and Laurent Simon of Cambridge University studied a range of Android devices and found that even though a "factory reset" is supposed to fully wipe storage, it often doesn't. Interestingly enough, full-device encryption could be compromised by the incomplete wiping too. ITnews reports: "The researchers estimated that 500 million Android devices may not fully wipe device disk partitions. As many as 630 million phones may not wipe internal SD cards. Five 'critical failures' were outlined in the researchers' Security Analysis of Android Factory Resets paper.
That's why you use encrypted storage. (Score:1)
That's why you use encrypted storage.
If you aren't able to use encrypted storage, then you destroy the device.
Re: (Score:1)
" Interestingly enough, full-device encryption could be compromised by the incomplete wiping too. "
If that's possible, then it isn't encryption. (Score:5, Informative)
No shit, you can get the encrypted data if it isn't wiped.
If the "encrypted" data can still be compromised, then it isn't truly encrypted, so encrypted storage isn't being used, and thus the "destroy the device" part applies.
Truly encrypted data is indistinguishable from random data to an attacker. In fact, that's even better than a reset device's storage being zeroed or oned out, since it doesn't indicate that the device had been obviously reset.
Besides, the summary is wrong. If you actually read the article, it says (emphasis added)
Re:If that's possible, then it isn't encryption. (Score:5, Informative)
Indeed - the whole point of full-disk encryption is that "reset" really consists of "zero the place where the master key was stored, which was encrypted by the user passphrase".
Do that, and do that effectively, and you don't have to touch ANYTHING else - it all becomes random gibberish without a valid key. It could literally mean just keeping a couple of hundred bytes of RAM in an EEPROM and then destroying it on "factory reset".
For convenience of detection, however, you may want to zero the first few sectors of the storage so that filesystem probes see it as "no filesystem" rather than as random gibberish. But that's got zero impact on the data that WAS within it.
There's a reason that everything before 4.4 was third-party encryption and untrusted. There's a reason that proper, system-level full storage encryption (including SD card encryption) required changes to the OS. Since then, however, you just need to make sure nobody has your passphrase to stop them getting into your device. Then make sure that nobody has the passphrase-encrypted key blocks at the beginning of the disk (usually) and the data is nothing more than random gibberish.
About the only thing needing a complete wipe of all data is really if you're put into duress to provide a key (which would obviously then provide the data) or if a key is discovered and someone wishes to prove that you DID hold the key / data (by provably decrypting with that key to show that it must have been the right one and, maybe, therefore that you had knowledge of it).
Wipe the key-block, and the encrypted data is basically undecryptable. Same way TrueCrypt etc. work. And even though your passphrase may only be 10 characters, the key block might well be hundreds of bytes long and THAT's what actually has to be decrypted first in order to get the real key to decrypt the rest of the data.
Re:If that's possible, then it isn't encryption. (Score:5, Interesting)
The Windows format command does this. If one uses it on a BitLocker encrypted volume, it will go and zero the parts on the volume that hold the BitLocker master key, so even if someone later has a recovery password, the data is still completely gone. Same with secure erase on a number of SSDs.
Since Android is sitting on a SSD, it might be wise to move to a smarter wiping system. One that would wipe the dm-crypt data, core places of the filesystem, and after that, TRIM the entire data partition before formatting and rebuilding it. The TRIM command helps ensure that the data present isn't recoverable at the drive level, and likely will get utterly destroyed when the drive erases the TRIMmed pages.
I read about some newer phones using a chip to store the encryption key for /data, similar to how iOS does it, but when hardware starts getting involved, it becomes harder to deal with a potential backdoor.
Maybe the ideal is a small bit of storage that is used, and if it is erased, the erasure is guarenteed (where there is no way to recover previously stored data.) Then, the master key is stored there. On initial bootup, the phone prompts the user for the PIN, decrypts the key stored on that small bit of storage for the master key to /data, and proceeds from there. On an erase, /data gets force unmounted, the small storage is erased, and a blkdiscard is issued for the /data's device. Not 100%, but it will pretty much ensure anything stashed in /data is gone.
Then there is the external SD card. Unlike /data, there isn't a real standard to encrypt that storage partition. Usually it winds up being encrypted on a file by file basis with some EncFS offshot. The key for this is stored in /data, so if the phone is wiped, there isn't any way to retrieve the SD card's data. What might be an idea would be to offer the file based mechanism, but also offer the ability to format the SD card and encrypt the entire card on a device level, not just on a file by file basis.
Of course, something like phonebookfs could be used so that someone looking at the encrypted file stash on the SD card can't tell between real data and randomly generated chaff, but that may not be something for mainstream phones.
Re: (Score:2)
All using ancient devices (Score:5, Informative)
"fragile full-disk encryption up to Android v4.4 (KitKat)."
"Twenty-six second-hand Android phones running versions 2.3 to 4.3 of the operating system, sold by five handset makers, were tested."
This paper did not look at Android 4.4 or above, IE, the only versions of Android that actually properly supported and advertised full disk encryption in the first place. Full disk encryption on any device prior to 4.4 was basically something the manufacturer cooked up.
If this paper shows anything to me, it is not so much about Android, it is more about how we have to force carriers to stop requiring this goddamn nonsense useless "carrier certification" so that Google can push device manufacturers to allow more direct and timely software updates.
Re: (Score:3)
Doesn't change much unless full disk encryption is enabled by default. In most cases it isn't. It still relies on a user doing something they typically won't do.
The real problem is that factory reset functions in the bootloader don't actually factory reset the phones. Factory reset means one thing and one thing only, a clean slate. There should be no scenario at all where a factory reset will preserve user data. Give the user the option to do a different form of reset, but don't ever preserve data and "clai
Re:All using ancient devices (Score:4, Insightful)
Yes, and how many of those devices are supposed to support the factory reset which wipes all the storage?
What's that? All of them?
Full disk encryption is one of 5 problems they found, but not the main one.
Disk encryption, in theory, should make the factory reset more robust. But the sense I get is that the factory reset is complete garbage independent of encryption on some of these devices.
Which mostly reaffirms that I have no interest in anything but the stock Google Android. Because by the time another entity has gotten their hands on it and tweaked it to advance their own commercial interests , you really have no idea of what holes they've introduced, and you have no idea how long before they'll drop support for it.
Carrier certification is shorthand for "all of our crapware needs to be checked if we get around it". The shit carriers put on phones is for their benefit, not ours. Because it's intended to drive traffic to their garbage.
Re: (Score:2)
Re: (Score:3)
Meh. Android 4.4 broke SD cards completely. My phone runs android 4.2, and it works, so I don't want to mess with it. I think that's how a lot of people are, despite security bug risks. I like Android in general but there's a lot I don't like. One of them is that updates are dependent on the vendor. The other is the murky world of semi-legal firmware distributions that rely on crappy forums for developer interaction with no public version control, no nice spots for download. Who knows what's in Joe's f
Re: (Score:2)
The good news is that there are apps (which require root) which will modify SELinux so that the SD card is usable. Since most SD cards are using FAT32, there isn't any real way to enforce permissions, so for security reasons, the card wound up being locked from most apps completely.
Of course, it would be nice if the SD card could be formatted with ext4, so permissions could be enforced.
Another option, which was part of Linux, but pulled out a long time ago, was the UMSDOS filesystem. What this did was put
Re: (Score:2)
Re: (Score:2)
On early phones, taking the SD card out of your phone and putting it in your computer was a common use case. It was usually a much faster way to get files onto it than tethering the phone by USB was. And those old phones had card slots that were right on the side of the device so the card was easy to remove and replace.
I remember doing that for my first smartphone (Sprint Evo 4G); the SD card was a pain to get to (you had to take off the back cover and remove the battery) but the phone's SD data transfer wa
Re: (Score:2)
Side slots suck because people tend to forget to unmount the card, with data integrity issues as a result. With the card behind the battery this is not an issue.
Re: (Score:2)
What's the definition for abuse? Keep coming back because the next time, it'll be better, I promise!
Re: (Score:2)
Newer phones respond to fstrim/blkdiscard, so one can use those tools to fire off TRIM commands, zeroing all data. For example, if one wants to ensure /data isn't available, one could do a blkdiscard of /data's device, or run fstrim on the mounted /data partition to have the SSD zero out all free pages. Similar with /system. Delete all extraneous data, mount it read-write, fstrim it.
Re: (Score:1)
While it is not so much about Android, it is bout Google. Apple managed to keep carriers out of their phones all together. Google could have as well, but they didn't. Everyone knew what a mess carriers were even back then (buy a ringtone from us for $4.99!), but Google went along with it.
Re: (Score:2)
This is basically the reason the new phone I got it not Android. They have a long track record of not being able to get updates onto phones. It is simply unacceptable to not receive any updates on a phone that I paid good money f
New news about Old software (Score:2, Informative)
The analysis paper starts out by saying "With hundreds of millions of devices expected to be traded by 2018, flaws...could be a serious problem." Unfortunately that same analysis focused on Android operating systems PRIOR to v4.4 (KitKat), which was released in October 2013 (https://en.wikipedia.org/wiki/Android_version_history).
Since then, Android has released major versions (4.4 Kitkat, 5.0 Lollipop) and various major updates within those families (4.4.2, 4.4.4, 5.1). To put this in perspective, they're
Re: (Score:1)
In a few years all those old phones are upgraded and sold, and the owner wants them clean.
Android 4.4 The newest version that they did not test. Is from October 2013. And I know that OME's takes some time to switch to new versions of Android.
But lets say that the last was switch one year later. So October 2014. That makes the phone 8 month old by now. And it was not a High End device.
So in a few years. Then it's a really old device. So how would buy it?
I can understand people want to sell there old phone. But a old Smartphone is OLD!!! And you can get new low/mid range devices pretty cheap
Hanlon's Razor (Score:3)
My guess is this isn't a case of cherry-picking, it's just that it took them 2-3 years to complete and publish the research. I wouldn't think it takes that long to acquire and study 21 phones, but looking at some of the dates in their paper, maybe it took *them* that long.
I don't think of this as ground-breaking research, it's more like archaeology. Better editorial surrounding the research could have been done in a "See how far we've come since 2013" type of way.
Re: (Score:2)
It sounds to me as though you think nobody is affected by this. The study refers to phones that are already in service and at an age where many people are considering trading up to newer devices -- potentially falling victim to a huge privacy and security issue. I have an Android device right beside me that falls into this category. It never occured to me -- until now -- that the factory reset function could potentially fail to sanitize its data storage. T-Mobile is my carrier and there have been exactl
Re: (Score:3)
I'll remember this when selling my device which I store TS-SCI rated data on.
FTFA, "Individuals buying devices on auction websites such as
eBay are possible attackers. They need to spend a nonnegligible
time to bid and follow up on auctions. Furthermore,
they have to pay a few dollars for commission
and shipping fees for each device. So low-value data
like contacts and email addresses do not seem profitable.
Recovery and analysis of conversations and images (to
blackmail victims) would generally require human inte
Re:New news about Old software (Score:4, Insightful)
Since then, Android has released major versions (4.4 Kitkat, 5.0 Lollipop) and various major updates within those families (4.4.2, 4.4.4, 5.1). To put this in perspective, they're talking about risks in 2018 from software no newer than 2013 while writing and publishing in 2015.
More than half of current devices in the hands of people have the versions which they tested.
There were many fixes in Android security systems in 4.4 and also in 5.0.
Which has nothing to do with factory reset, a function implemented by the manufacturer and not a function of Android itself. Unless the manufacturers have picked up on it, 5.0 devices are just as likely to preserve user data as previous devices.
5.0 now supports hardware encryption on e.g. HTC and OnePlusOne platforms among others.
Supports means nothing. No actually it means a lot. Hardware encryption is currently supported by a tiny TINY portion of the handsets out there. But here's a fun fact for you, supported doesn't mean the end user will use it. 5.0 does not mandate encryption by default. It's not an opt out process. I don't even need to guess how many users went out of their way to turn this feature on.
but in this case the hype cherry-picks data that ignores two years of active open-source development and many security updates
All which mean diddleysquat in practical terms if the updates haven't filtered down to the population, and the updates mandate proper security practices. Neither of which has occurred in the past 2 years.
Re: (Score:2)
And what do you call a person who continues to support this business model?
Comment removed (Score:5, Interesting)
Re:Android. The "PC" of mobile devices (Score:5, Interesting)
Re: (Score:2)
I like Android's customizability and the ability to replace things. For example, I toss the launcher and go with Nova's. The keyboard app gets replaced, and I use a custom texting app that supports encryption.
Plus, I have more privacy on Android with XPrivacy. For example, a lot of apps pull your ad info, IMEI, hardware serial number, and anything they can find for behavioral tracking. With XPrivacy, the app will happily get a number... but it will be a random one. I can also ad block on the IP level.
Re: (Score:2)
The nice thing about PCs is that you can update the software yourself. I like the selection that you get with Android, but 99.9% of the handsets are a terrible choice. When I get a laptop or desktop, I can put Windows, Linux, or even BSD on it if I want to, and nobody tries to stop me. I can update the software whenever I want. I've been running the same desktop for 9 years, and it still works fine because I control the software that runs on it.
Re: (Score:2, Insightful)
I don't understand your logic. If for example, Samsung and LG make decent Android devices and provide support for them, you could buy from them and get a decent consistant Android device and support. Your logic implies you will avoid the whole platform because somehow a chinese company Hawichezza can make a crappy Android device and that makes Samsung and LG products and support for their products less desirable? I don't follow.
Do you drink wine or beer? The top quality products of beer and wine are in
Re: (Score:2, Insightful)
No don't you see? He's saying that he would rather just always drink Budweiser, where he knows he's got the programming of decades of advertising, and a multibillion dollar ongoing marketing campaign to brainwash him into loving it more than any other beer, without even having to go to the trouble of tasting it (which probably wouldn't work out for the best anyway)
Re: (Score:2)
If for example, Samsung and LG make decent Android devices and provide support for them, you could buy from them and get a decent consistant Android device and support.
If that were the case, you'd be safe. I don't know of a manufacturer that consistently provides bug-free devices and support for them for, say, 2 years back.
You are generally safe with Nexus devices, since you have the best chance of upgrading to the latest OS. This helps with vulnerabilities which won't be fixed in older versions of Android [arstechnica.com]. But because Nexus devices shuffle between different manufacturers, you lack consistency from a hardware standpoint.
Re: (Score:2)
If that were the case, you'd be safe. I don't know of a manufacturer that consistently provides bug-free devices and support for them for, say, 2 years back.
I don't know of any manufacturer, Apple included, that consistently provides bug-free devices. But if 2 years of updates is your benchmark, Samsung meets it. They have Android Lollipop (5.0.1) running on their Galaxy S4 (released April 29, 2013, so it's just over 2 years old). Granted, 5.1.1 is the true latest and greatest Android version, but it was only released on April 21, 2015, so it's a unrealistic to expect Samsung to push that out to a 2 year old device so quickly.
Re: (Score:2)
The Samsung Galaxy S4 is a single handset among many that they offer. My Wife as the Samsung Galaxy Core LTE [gsmarena.com], which is much newer than the S4 (November 2014) and still doesn't have an update to Lollipop. So, while some handsets from some manufacturers get updates, I haven't seen an Android handset manufacturer that updates all their devices in a timely manner for 2 years.
Re: (Score:2)
Well, I guess it's flagships only or something. I dunno. Looks like the Galaxy Core LTE hasn't been out long, so maybe that's why? I wouldn't even want to speculate.
Re: (Score:2)
A device with an unlocked bootloader is also more likely to be more future-proof. I have a newer version of KitKat running on my Galaxy Tab 2 7.0 (4.4.4) than on my considerably newer Moto X (4.4). The tablet's running Cyanogenmod...have no idea if Samsung ever got around to spinning a KitKat build for it, and don't particularly care at this point as the only thing that doesn't work under Cyanogenmod
Comment removed (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Apparently you are unable to grasp the concept of "they've given up".
For some, a straightjacket is high fashion (Score:2)
There's nothing wrong with that, but it doesn't really apply to everyone. And the cost of data security is dimissively low. For the typical Android handset, the simple blow of a hammer instead of trying to recover less than $100 on ebay or craigslist will guarantee security of your old data. Heck, that $100 is less than the differential between an android handset and an equivalent iOS device in most cases.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Similarly here. Except I switched to Windows Phone. Apple phones, while well supported and good quality, are just a little too pricey for me. Samsung and LG are not without their faults either. Maybe on a few select flagship phones they have updates but the majority of their handsets have just as few updates as all the other manufacturers. My previous LG phone was released 6 months before Android 4 came out, and I never saw a single software update to that phone, so I was stuck with Android 2.3
On a side
Re: (Score:2)
See, this is why I'm a convert to Apple iOS. Yes, there are a few reputable hardware vendors for Android like Samsung and LG; and in many cases, superior hardware specs for the latest device. The problem is the hardware/software permutation and lack of post-sales support and upgrades. THIS is why I abhor the Android platform.
I get your point about lack of post-sales support and upgrades. However, I don't understand how hardware/software permutation is a problem. You only need one good device. Why would I care if a cheap device I didn't buy from one of these chinese vendors is buggy and lacks support?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I tried this, but it wouldn't run my Android apps.
Re: (Score:2)
I tried this, but it wouldn't run my Android apps.
You say that like it is a bad thing.
Old bug is old. (Score:1)
Re: (Score:2)
Affects Android 2.3, aka Gingerbread. Does anyone even use Gingerbread anymore?
Yes.
Re: (Score:2)
You are unaware that a lot of cheapo phones, currently on the market, especially those for 3rd world countries, run 2.3?
Second shocker: formatting your HD (Score:2)
Bad news: formatting your hard drive or reinstalling your OS (any consumer OS) doesn't, by default, actually erase your data either.
Why are we surprised?
Re: (Score:2)
Bad news: formatting your hard drive or reinstalling your OS (any consumer OS) doesn't, by default, actually erase your data either.
Why are we surprised?
But we do have options. The fact that people are willing to store so much personal data on their smartphones is just showing us how dumb they are. Why would they not think a factory reset wouldn't wipe their data. If the thought even crossed their mind.
If they even thought to do a factory reset in the first place.
And this incrypton thing, sounds like a lot of work - Swamp people is on, and I can't miss that! Many of us are doing well to get our shoes tied in the morning.
Re: (Score:3)
Bad news: formatting your hard drive or reinstalling your OS (any consumer OS) doesn't, by default, actually erase your data either.
Why are we surprised?
But we do have options. The fact that people are willing to store so much personal data on their smartphones is just showing us how dumb they are. Why would they not think a factory reset wouldn't wipe their data. If the thought even crossed their mind.
Probably because of the pop up that says all your information will be wiped?
Re: (Score:2)
Probably because of the pop up that says all your information will be wiped?
All you have to do is believe it.
Best secure wipe is 25 pounds of thermite. It does void the warranty however.
Well, duh (Score:1)
That's why products like Cerberus can tell you where the scumbag who nicked your phone is, even if said scumbag deletes apps and data via factory reset.
why should it? (Score:2)
I wouldn't expect it to "wipe storage", nor would I want it to. Flash storage has a limited number of write cycles, and people do factory resets much more frequently during the lifetime of a product than wiping the device in order to recycle it. If you want to erase storage, use the "erase storage" function.
I noticed that on my own phone (Score:2)
Old news (Score:1)
Anti-virus company Avast! bought a bunch of phones and published their findings last year on the same subject
http://yro.slashdot.org/story/14/07/09/0034244/avast-buys-20-used-phones-recovers-40000-deleted-photos
Pull the SD card (Score:2)
Yep (Score:2)
I bought a cheap tablet for 35 AUD from officeworks. The normal price was 45 AUD but this device was pink (for kids) and had been returned. I took it home, and when I experimented with the gallery I found selfies taken by a child. I ran the factory reset but the pictures were still there so I just deleted the photos.