Slashdot Mirror
Wiping a Smartphone Still Leaves Data Behind
KindMind writes "To probably no one's surprise, wiping a smartphone by standard methods doesn't get all the data erased. From an article at Wired: 'Problem is, even if you do everything right, there can still be lots of personal data left behind. Simply restoring a phone to its factory settings won't completely clear it of data. Even if you use the built-in tools to wipe it, when you go to sell your phone on Craigslist you may be selling all sorts of things along with it that are far more valuable — your name, birth date, Social Security number and home address, for example. ... [On a wiped iPhone 3G, mobile forensics specialist Lee Reiber] found a large amount of deleted personal data that he recovered because it had not been overwritten. He was able to find hundreds of phone numbers from a contacts database. Worse, he found a list of nearly every Wi-Fi and cellular access point the phone had ever come across — 68,390 Wi-Fi points and 61,202 cell sites. (This was the same location data tracking that landed Apple in a privacy flap a few years ago, and caused it to change its collection methods.) Even if the phone had never connected to any of the Wi-Fi access points, iOS was still logging them, and Reiber was able to grab them and piece together a trail of where the phone had been turned on.'"
That's why I used a sledgehammer and a group of beefy muscular friends to wipe mine out. 7 in fact.
Did the previous owner use the "erase all content and settings" feature of that phone? Or just restore it. That would have been using the built in tool and would have overwrote the data. http://support.apple.com/kb/ht2110
Why would my phone know my social security number? Has anyone ever had to input this?
This wouldn't be an issue if cell phones were unlocked and the firmware and OS was GPLed.
Without the development of a secure wipe tool for mobile devices, all your information is easily available to retrieve as long as you know what you are doing. Look up tools like FTK or Encase.
Most decent cell phones have built-in encryption which wipes the phone by simply deleting the built-in keys. Some cheap-ass droids and the 'feature-phones' may not have it built-in but it's fairly easy to wipe a phone that has the feature.
Off course, if you use the wrong methods (such as simply 'restoring' the phone) or using unencrypted external media, not much is going to help you. If you really need to get rid of your data (eg. in an enterprise environment) I would hope those in charge of the devices would know how to configure and manage the phones correctly so they can be remotely wiped etc
Custom electronics and digital signage for your business: www.evcircuits.com
The key line: "On a wiped iPhone 3G"
Starting with the iPhone3GS, iOS encrypts everything with a random AES256 key. When you say to wipe the device, it erases that key rendering everything else unusable. This is mentioned in the article, but downplayed. It's been a long time since you could even buy an iPhone 3G, so it seems alarmist to bring it up now.
http://blog.itsecurityexpert.co.uk/2011/10/securely-wiping-your-personal-data-from.html
on their phone??
Or drive a few miles around Manhattan.
Did the previous owner use the "erase all content and settings" feature of that phone? Or just restore it. That would have been using the built in tool and would have overwrote the data. http://support.apple.com/kb/ht2110
The author used the last iPhone (3G) running the last iOS version (4) that would exhibit such behavior. It seems a contrived test.
An upgrade to iOS 5 would fix the problem on the 3G. On newer phones the encryption key needed to access the data is destroyed, so the problem never would have occurred.
I'd be more interested to see if he can still do it on a newer model. The earlier models of iPhones were well known to have poor security.
Well, it has never been successfully tested.
EXACTLY. Wish my mod points hadn't expired.
we rounded up every old phone we could scrounge up from around the office and asked the owners to wipe them. Our stash consisted of two iPhone 3G models, two Motorola Droids, an LG Dare and an LG Optimus.
There were similar discrepancies in what Reiber found on the two iPhones, although both were 3G models running iOS 4
It’s worth noting that the iPhone 3GS and newer versions use a hardware encryption key which is deleted when the phone is wiped, but data was easily recovered from these older models.
Oh no! Five-year-old* long-discontinued phones running old OSes lack security! The horror!
* okay, the Droid is only 4 years old, and the Optimus a mere 3. (And both shipped with Android 2.0 or earlier.)
How can I believe you when you tell me what I don't want to hear?
http://www.accessdata.com/products/digital-forensics/mobile-phone-examiner On-the-Fly Decryption of Operating System and Logical Data of iOS
'Smartphone' is a general term, but this article is about specific smartphones. "Our stash consisted of two iPhone 3G models, two Motorola Droids, an LG Dare and an LG Optimus. (We had hoped for a BlackBerry, but nobody had one.)" As usual, BlackBerry is not only excluded from the test, but the technology 'journalists' had to throw in a swipe at BlackBerry, which, to me, is an admission of their own incompetence. A BlackBerry device probably would pass the test with flying colors, just as these devices do with most every security test. I'm not claiming that BlackBerry should be best selling phones or that they are the greatest ever, just that credit should be given where it is due.
I once took an excursion to Reddit, and later HN. Unlimited up/down voting sucks when dealing with a hive-mind.
While referring to getting all data erased.
'Problem is, even if you do everything right, there can still be lots of personal data left behind.
Wouldn't that mean you just didn't do everything right? Huh?
Google doesn't help matters by providing no avenue for de-linking one's no-longer-owned device from an existing [Google Play] account. Sad.
Some napkin math, assuming he purchased the phone in July 2008 when 3G went on sale, and it's been in use constantly for the last 57 months ... and ball-parking 30 days/month ... he hit 40 Wi-Fi points and 36 cell towers every day.
Even with the assumption that these are not unique access points (i.e. his home WiFi is counted 3 or 4 times a day, depending on how often he comes and goes) ... that's still an insane number. If we change the time-frame to 2 years, roughly the average lifespan between upgrades, he's up to 95 WiFi points per day.
Quite the busy bee.
This signature is false.
The article makes no mention of WHICH Android revision each of the given phones tested was using.
It was a known problem with Gingerbread and earlier that the wipe method used by most Android devices was insufficient. That's why Google added secure erase prior to reformat with ICS (maybe HC too, not sure...)
https://android.googlesource.com/platform/system/extras/+/c2470654d4b4db09a7052fc5fa108ac21f1b1948
Interesting result of this: Samsung's eMMC chips that were shipped in the Galaxy S II and original Galaxy Note couldn't handle this secure erase command properly, and using a standard "secure" wipe had a pretty good chance of corrupting the wear leveller so badly the chip would be rendered useless. (Samsung's own recoveries were "neutered" so as not to issue a secure erase command.)
TL;DR - Unless crippled by the manufacturer, any recent Android device (ICS or newer) should not have any of the issues with data remaining easily recoverable after a wipe described by this article. LG didn't do anything special here - they just implemented ICS or later and that's all that was needed.
retrorocket.o not found, launch anyway?
More than just contrived, it is very intellectually dishonest...
The author used the last iPhone (3G) running the last iOS version (4) that would exhibit such behavior. It seems a contrived test. An upgrade to iOS 5 would fix the problem on the 3G. On newer phones the encryption key needed to access the data is destroyed, so the problem never would have occurred.
Sorry, but the iPhone 3G tops out at version 4.1.2. The 3GS, on the other hand, does have support for iOS 6, if I remember correctly.
Even with the assumption that these are not unique access points ... that's still an insane number. If we change the time-frame to 2 years, roughly the average lifespan between upgrades, he's up to 95 WiFi points per day.
If the wifi points are non-unique, 100 wifi points per day would be downright easy to achieve. I probably pass far more than that on the way to and from work each day on the bus.
Remember, it's not "how many networks have you connected to" but "how many have come in range of your antenna."
Unique points would be a lot harder to hit, but as someone else points out, you could probably rack up access points very quickly in a metropolitan area.
Van der Graaf Generator?
Oxy-acetylene torch?
Cement kiln?
I know what to do with a hard drive (DBAN followed by drill press) and a DVD (shredder).
Yep. I have 6 on my 3GS. The first gen iPad doesn't though.
[John]
Shit better not happen!
How the hell on EARTH do you have "61,202 cell sites" without de-duping?
Then I checked the US wireless quick facts and found:
June-12 June-07 June-02 June-97
285,561 210,360 131,350 38,650
Yikes, that's quite the expansion... but regardless, it still means this phone would've travelled through a very large number of dense American cities to get up to that count.
Bye!
The author used the last iPhone (3G) running the last iOS version (4) that would exhibit such behavior. It seems a contrived test. An upgrade to iOS 5 would fix the problem on the 3G. On newer phones the encryption key needed to access the data is destroyed, so the problem never would have occurred.
Sorry, but the iPhone 3G tops out at version 4.1.2. The 3GS, on the other hand, does have support for iOS 6, if I remember correctly.
My bad. I might have been thinking of the iPod 3rd gen which tops out at 5.1. The iPhone 3GS (also 3rd gen) is supported by iOS 6.1, the current version.
Which begs the question: "How do blind people know when to stop wiping?"
Solving Unix problems since 1989...
As others have pointed out, the iPhone 3G topped out at iOS 4 (and that's if you can't deal with how slowly it ran). Even if it could run iOS 5, you neglected the possibility that the person could have sold the phone before iOS 5 even came out. My iPhone 3G definitely had no such erase option and since the damn phone refuses to mount like a proper USB device, I was not able to use software from my laptop to securely wipe the phone before selling it. Oh well, at least I haven't had my identity stolen yet.
After erasing the contents fill the 3G with music to overwrite, then erase again?
But you're assuming that everyone who had an older phone ran out and ditched it the moment the new ones came out and thus there are no older iPhones with older software in use.
Oh wait... we're talking about Apple. Ok, yeah, everyone DID immediately ditch their old phone the moment the new model came out. Nevermind.
This space available.
I know that many blind people fill cups with liquid by putting a finger in the cup, and feeling when it's full. Maybe they use the same sense of touch in this case ....... I've got to stop shaking blind people's hands.
Quick, someone tell 2008 that they have a problem with phone security.
I tried to call the iPhone owners but they were all on AT&T and had no reception.
Then I tried to call all the Android owners but their batteries were all dead...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
But you're assuming that everyone who had an older phone ran out and ditched it the moment the new ones came out and thus there are no older iPhones with older software in use.
Oh wait... we're talking about Apple. Ok, yeah, everyone DID immediately ditch their old phone the moment the new model came out. Nevermind.
Its been nearly 3 years since the 3G has been sold. Both iPhone and Android users tend to have phones less than 3 years old.
Some napkin math, assuming he purchased the phone in July 2008 when 3G went on sale, and it's been in use constantly for the last 57 months ... and ball-parking 30 days/month ... he hit 40 Wi-Fi points and 36 cell towers every day.
Not that difficult. Just sitting at my desk, my Galaxy S3 picks up 36 Wi-Fi networks. I probably walk past that many again on my way to work. And a few dozen more any time I walk into an apartment building.
I consider it rather mystical how any Wi-Fi network is able to function at all with this amount of crowding in the channels.
upon the advice of my lawyer, i have no sig at this time
This was to prove that selling your OLD PHONE can raise security issues
Only the State obtains its revenue by coercion. - Murray Rothbard
pound it to smithereens with an 8 pound sledge hammer, nothing but crumbs left when i am done
Politics is Treachery, Religion is Brainwashing
I just talked to the forensics guys I know, I was wrong. And you are correct.
How many times are you going to quote that article without understanding WTF you're quoting? And you call yourself a CEH?
Jesus Christ.
After erasing the contents fill the 3G with music to overwrite, then erase again?
Pretty sure the filesystem in iOS can have partially empty blocks. I'd make a copy of my music, then run find . -type f -print0 | perl -n0e 'truncate($_, -s $_ >> 13 13)' to make sure that all the files were rounded off to 4096 bytes first.
I just thought to check for apps that wipe storage, there are several. I should have known there was an app for that. :-)
It could have been in an email:
* State/gov authorities.
* Insurance company.
* Your doctor
* Digital copy of payslip
etc.
Do you not have access to your email via your phone?
"We mustn't be caught by surprise by our own advancing technology" -- Aldous Huxley
Or the wi-fi access point MAC address was duplicated by some cheap SE Asian company?
I'd say there is a higher probability the location data was just wrong.
No so contrived. These are the phones that are entering the used market. The early adopters are getting the next great iPhone and selling their old one. A lot of these users don't want to spend time or money upgrading the OS of an old phone and may be blissfully unaware of the security issues of the outdated OS.
Actually, I was wrong, I misunderstood somethings. Not afraid to admit I was wrong.
I see 11 access points sitting at home, in a chunky brick building. If I take the metro into central London I go past 10 access points just underground (in the stations, and that's only the public ones).
Heading straight home gives another 10 + 11, so that's already over your average.
(My own router's signal doesn't reach from one end of the flat to the other, due to the chunky walls, and most of the 11 signals I see are very weak, so I probably hit 5-10 see-you see-you-nots just going to the kitchen and back.)
I actually cycle to work. I wonder if my phone has enough time to detect all the residential connections I go past? I doubt it, but there should be enough slow bits (corners, junctions) to plot my route exactly.
Or he rides the train. In addition to the fleeting contacts from outside, there's people tethering on the train.
It's still quite a lot, but I suppose it's vaguely possible.
Destroy it instead. It's enormously gratifying to reduce a smart phone to powder. And try reading that.
It was also a iphone 3, the 3G and newer all solved this problem. The Article is horribly out of date.
Do not look at laser with remaining good eye.
Once again, blackberries solved this problem about 10 years ago (or more).
If you want real, audited, certified security, get a blackberry.
If security isn't important to you, android & iphone are fine.
Sadly, most people are in the latter category.
Since I got an OG Droid in November of 2009, I've purposefully observed 132,205 non-unique access points just in the course of normal short traveling for work and pleasure, exclusively by car.
I am unsurprised by any of these figures.
Kid-proof tablet..
When you wipe so hard it causes you to sneeze, you can stop.
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
Ah, NON-unique. Yes, it's not at all surprising then.
And 93,077 unique access points, over the same period.
Kid-proof tablet..
I'm actually impressed. Good for you.
The author used the last iPhone (3G) running the last iOS version (4) that would exhibit such behavior. It seems a contrived test.
It's only contrived if you fail to consider that most people who are SELLING a USED iPhone on Craigslist are selling their OLD model, not the new one they just purchased.
The 3G is not simply an old model, its an obsolete model. Many actively supported apps won't support its CPU (armv6), amount of RAM (128MB), or OS version (4.2.1). The 3G was replaced by the 3GS nearly 4 years ago, it sales slowed before that due to the impending release of the 3GS, and it has not even been offered as a low end budget alternative for nearly 3 years. I expect the used iPhones being sold today are generally iPhone 3GS or 4, phones that are supported by the current version of iOS and actively supported by apps.
Now if you want to complain that a phone sold 3 years ago is obsolete, well that is a different topic and I'm likely to agree with you. But with respect to the topic of today's used iPhone market, focusing on the 3G does seem contrived for the reasons above.
To avoid redundant posts ... http://slashdot.org/comments.pl?sid=3607997&cid=43344171
Either you work in a very very crowded area, or San Diego is seriously slacking in the Wireless department.
There are exactly zero visible wireless signal available from my office. My company's SSID is not broadcast, and it's a fairly large campus, so no others can make the trip in. From my home, I can see a few, maybe 3 or 4 on a good day (including my own.) Perhaps people in my neighborhood just keep their SSIDs hidden.
Some more napkin math time! Assuming you're on flat ground (because it's been a LONG while since I took advanced geometry ... trying to figure this out in 3 dimensions would make my brain hurt at this hour) And giving each WAP an average range of 100 feet to your phone ... the access points would have to be arranged in a perfect grid at roughly 30 foot intervals (starting with the one you're sitting on top of) in order for you to see 36 from the central point.
(100 ft radius = 31,400 sqft circle) / 36 chunks = 875 sqfeet per chunk ... sqrt ... 29 and change.
Certainly not impossible, though if you think that you need a separate access point from someone less than 30m away, I think that you need to work on your interpersonal skills ;) (for reference, 30 feet is 8 - 12 paces, depending on the size of your stride.)
This signature is false.
Either you work in a very very crowded area, or San Diego is seriously slacking in the Wireless department. There are exactly zero visible wireless signal available from my office. My company's SSID is not broadcast, and it's a fairly large campus, so no others can make the trip in. From my home, I can see a few, maybe 3 or 4 on a good day (including my own.) Perhaps people in my neighborhood just keep their SSIDs hidden.
Depending on where exactly I am in my apartment (I can move a few feet and the number changes), from three sample points I see between 20 and 28 different networks at home. There were 15 or 20 visible from my office earlier today. Going down a street where there are a lot of apartments, I wouldn't be surprised if I see 40.
Things like your 2D assumption really get destroyed by apartment buildings, not to mention your statement that "if you think that you need a separate access point from someone less than 30m away, I think that you need to work on your interpersonal skills" :-).
If anyone knows a way -- either on Linux or Windows 7 -- to record a list of SSIDs which are visible over time, I'll run it on my bus ride and see how many unique networks are visible during the entire route.
Going down a street where there are a lot of apartments, I wouldn't be surprised if I see 40.
By the way, that's 40 at once, along most of the street. I'd be surprised if I don't see 100 different networks at one point or another from one end of the street to another.
The dog stops licking.
English is not this
"Will it blend?"
Rick B.
Either you work in a very very crowded area, or San Diego is seriously slacking in the Wireless department
And giving each WAP an average range of 100 feet to your phone
Downtown core in a city of 200k.
My number is probably inflated a bit given that my desk is ~80m off the ground and next to a window. According to opensignal's DB, some of the networks I'm detecting are 1000+ feet away.
upon the advice of my lawyer, i have no sig at this time
If anyone knows a way -- either on Linux or Windows 7 -- to record a list of SSIDs which are visible over time, I'll run it on my bus ride and see how many unique networks are visible during the entire route.
InSSIDer might be what you're looking for. Also available for Android and Mac.
upon the advice of my lawyer, i have no sig at this time
If anyone knows a way -- either on Linux or Windows 7 -- to record a list of SSIDs which are visible over time, I'll run it on my bus ride and see how many unique networks are visible during the entire route.
I'd actually be interested in this as well. Hopefully there's a tool that doesn't require a "Smartphone forensics" degree. I only see a few networks whenever I look ... but that doesn't mean I'm not passing through the range of many more. I intentionally set my phone to *NOT* pop up and ask me about every stinkin' wireless network it sees. Joins the ones I know, ignores the rest, and I add new ones manually ... so maybe I'm missing the real quantity.
I'd also be interested in some real world tests of viable WiFi range. Sure the manufacturer puts their specs on, or their best guess ... but I'd wager that you get significantly reduced signal through 5 floors of apartment building (with microwaves, cordless phones, and everything else in the way) as opposed to 50 feet of open field. Go Go Science. Looks like I have something to do this weekend.
P.S. I was being fairly honest with the interpersonal skills comment, only slightly snarky. I provide an SSID at home that a few of my neighbors use. We're all friends, and I trust them not to do anything immensely scandalous... or if they do, well, it provides plausible dependability for anything that I might be doing on the "same IP." Seems like a similar arrangement could be made all the easier in an apartment setting. Split the bill among 3 rooms, the middle room actually gets the service and shares with those on either side of him.
This signature is false.
I'd actually be interested in this as well. Hopefully there's a tool that doesn't require a "Smartphone forensics" degree. I only see a few networks whenever I look ... but that doesn't mean I'm not passing through the range of many more.
So what I wound up doing was using the iw dev wlan0 scan command in Linux to list information, from which I grep'd out the SSID: blah lines. I then ran this with a 2 or 3 second pause inside of a shell for loop as I rode in. I'll post results this evening, but with a caveat, there were a couple points where iw dev wlan0 scan | grep SSID returned over 100 networks. I don't even live in a metropolitan area; most of my ride in is quite suburban.
There were 1,644 unique network SSIDs reported during my 30-minute ride in.
(The caveat is I think there is some "drag" of what networks it reports. For instance, if it sees network Foo at one moment, I think that will be reported for a bit longer even after it's no longer in range. Because of this drag, I'm not sure that there were actually ever more than 100 networks in range.)
Next question?
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
I graphed the number of networks visible in the morning and evening commutes. The first ~5 min of the morning commute is sitting stationary. The vertical lines are caused by the obnoxious-as-hell network manager that comes with Ubuntu accessing the interface and causing a "device or resource busy" error with my thing, which causes a report of 0 networks in range. Remember the drag I mentioned before: the three big peaks little after 10AM correspond to the three most popular stops along the street with bigger apartment buildings, but the decline from the peaks occurred even as the bus was sitting before.
There were >1600 unique SSIDs seen in the morning commute, >1200 in the evening one, and >1800 total.
The way I collected this data was to:
collect it with for num in $(seq 1 3600); do iw dev wlan0 scan > $num.txt; sleep 2; done
convert it to CSV with for file in *.txt; do echo "$file, $(stat --printf="%y" $file | cut -f2 -d" "), $(wc -l net.csv
and then graph it in LO Calc.