Factory reset FAILS in 500 MEEELLION Android phones

Cambridge University boffins Laurent Simon and Ross Anderson say half a billion Android phones could have data recovered and Google accounts compromised thanks to flaws in the default wiping feature.

The gaffe allows tokens for Google and Facebook among others to be recovered in 80 percent of cases. Encryption keys can also be recovered and can with some brute-force password guessing allow attackers to access previously wiped data.

Those keys, along with a host of data including SMS, photos, and videos, can be recovered because the factory reset process in Android 4.3 Jellybean and below is flawed, the pair say in the paper Security Analysis of Android Factory Resets (PDF).

Here's the gist of it:

We estimate that up to 500 million devices may not properly sanitise their data partition where credentials and other sensitive data are stored, and up to 630 million may not properly sanitise the internal SD card where multimedia files are generally saved.
We found we could recover Google credentials on all devices presenting a flawed factory reset. Full-disk encryption has the potential to mitigate the problem, but we found that a flawed factory reset leaves behind enough data for the encryption key to be recovered.

Read more...