Factory reset in Android phones leaves sensitive user data behind

Researchers recovered access credentials, emails, text messages and other sensitive information from wiped Android phones

Android apps

Android apps

It's common sense to reset an Android phone to its factory state before selling or disposing of it. But beware, researchers recently found that this often fails to properly wipe all sensitive user data from the device.

A test on 21 second-hand smartphones running Android versions between 2.3.x (Gingerbread) and 4.3 (Jelly Bean) revealed that it's possible to recover emails, text messages, Google access tokens and other sensitive data after the factory reset function had been used.

The study was done by researchers Laurent Simon and Ross Anderson from the University of Cambridge in the U.K. on used devices bought from eBay between January and May 2014. The devices included models from Samsung Electronics, HTC, LG Electronics, Motorola and three from Google's Nexus line of phones.

In 80 percent of cases the researchers managed to recover the Google master token that could allow an attacker to re-synchronize the device with the previous owner's Google account, gaining access to the emails, contacts, Wi-Fi passwords and other data backed up to that account.

In some cases they also recovered access tokens from apps such as Facebook, portions of emails, SMS messages and other instant messaging conversations.

"The reasons for failure are complex; new phones are generally better than old ones, and Google's own brand phones are better than the OEM offerings," Ross Anderson said in a blog post. "However the vendors need to do a fair bit of work, and users need to take a fair amount of care."

Encrypting the phone can help mitigate some of the risk, but not completely. The researchers found that in some cases an attacker could recover enough information after a factory reset operation to break the encryption key using brute-force techniques. In order to prevent this, it's essential for phone owners to set a strong password when encrypting their phones, as 4-digit PINs are easy to crack.

Based on their findings, the researchers estimate that up to 500 million devices may not properly erase the data partition where the OS and apps store credentials and up to 630 million may not sanitize the SD card where multimedia files such as photos and videos are typically saved.

In a separate study, the researchers analyzed anti-theft features like remote device locking and wiping offered by top mobile security apps. Their conclusion was that these apps do not represent an alternative to the flawed built-in factory reset, because they are limited by the OS architecture and APIs in what they can do.

The only viable solution would be improvements to the data wiping mechanism made by the phone vendors themselves, the researchers said.

It's not clear if the factory reset function has been improved in Android versions newer than 4.3.

Google did not immediately respond to a request for comment.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Motorolauniversity of cambridgeLG Electronicssecuritymobile securitySamsung ElectronicsForensicsdata protectionprivacyhtcGoogle

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?