Ask Slashdot: How Can I Prepare For the Theft of My Android Phone?

New submitter Adam Jorgensen writes "Last week my 4-week old Moto G phone was stolen while getting onto the train at Salt River in Cape Town, South Africa. That in itself is no big deal. Cellphone theft is a huge problem here in South Africa and I've had at least two previous cellphones stolen. The big deal this time, for me at least, was that this was the first time I've lost an Android phone to theft. When I actually sat down and thought about it, losing a fully configured Android phone is actually a big deal as it provides ready access to all kinds of accounts, including ones Google account. This could potentially allow the thief to engage in all kinds of malicious behavior, some of which could have major implications beyond the scope of the theft.

Luckily for me it seems that the thief did the usual thing: Dumped the SIM card, wiped the phone, and switched it off. It's probably had its IMEI changed by now and been sold on to some oblivious punter, possibly some oblivious punter in another country. Still, the potential for serious issue is making me have second thoughts about replacing the phone with anything capable of doing much more than calling. My question is this: Are there any serious solutions out there for Android that secure against theft?"

He continues:

By serious I mean solutions that go beyond the laughably easy to defeat 'Find My Phone' and 'Remote Wipe' options provided at present. Presently I'm thinking along the lines of:

• Full encryption of phone contents
• Some kind of 'Travel Safe' mode that would lock the phone down and trigger a full wipe of not unlocked correctly (Including wiping the phone on next boot if not unlocked before being switched off/running out of battery).

So, any ideas?"

Comments

Seriously?

[LordLimecat]

Encrypt the phone, and set a numeric PIN of 6 or more.

Done and done.

Re:Seriously?

[dfsmith]

Thanks! I set my PIN to "7".

Re:Seriously?

[LordLimecat]

Followup, in case you dont know how to do that:
http://www.howtogeek.com/14195...
Its been available for quite some time IIRC.

Re:Seriously?

[Charliemopps]

Exactly, if the phones encrypted they're going to have to wipe it to use it. Ok, yea, if the NSA gets the phone, I'm sure they could guess the password eventually, but I doubt you're a political dissident or whatever. You could also get one of many programs that let you remotely control or locate your phone. Yes, if they turn it off you're not going to find it but at least you have a decent chance. The number of criminals that are smart enough to plan for such things are few and far between.

Re:Seriously?

[slashgordo.]

After encrypting the phone with a good passwd/pin, go to all apps -> Google Settings app -> Android Device Manager, and enable "Remotely locate this device" and "Allow remote lock and erase". Then if it does get stolen, you can use the Device Manager app or https://www.google.com/android... to find it or remotely wipe it. Then go to your Google account settings at https://security.google.com/se... , select your device and "Revoke Access". If you used an application specific password for your Android device, go to https://accounts.google.com/b/... and revoke it. Change your Google password. If you used 2-step verification, move the Google Authenticator to a different device, and re-seed the keys with a new QR code. It is scary how much important private stuff we keep on these portable smartphones, tablets, etc these days, and how screwed we could be if that falls into the wrong hands.

Re:Seriously?

[Anonymous Coward]

None of the things will protect against theft.

The thief will still pick your pocket. When they get back to their evil lair, they will find it is password protected. If they try to break the protection (which is easy with the right tools) they will find it is encrypted. Then they will trash the device or perhaps attempt to sell it. For you it doesn't matter, your device is still stolen and must be replaced.

There are tons of tools out there to make backups so restoration is easy on a new device. But your device is still stolen and must be replaced.

Encryption has jack shit to do with recovering the hardware.

Your data and personal information contained on the phone can be proven far more valuable and far more difficult to recover from if leaked.

Neither of these facts belie your ignorance here. Use your damn head. Encryption helps mitigate a rather specific problem with phone theft.

Re:Seriously?

[K. S. Kyosuke]

You've set it awfully low, most phones these days go at least up to "11".

Re:Seriously?

[PopeRatzo]

I doubt you're a political dissident or whatever.

Well...

Re:Seriously?

[nullchar]

If you've done a factory reset, then the phone owner doesn't need to worry about their data anymore...

Re:Seriously?

[mlts]

Here is what I do to secure my Android device:

1: Unlock the bootloader, flash a CM or custom ROM that doesn't sport crapware.

2: Encrypt the device with a screen locker PIN 4+ digits. I personally use six for this, just for ease of typing.

3: Use "su -c vdc cryptfs changepw foobar" to change the passphrase. This separates the passphrase Android asks for at boot versus the screen unlocker PIN. Of course, if you change the screen password, the cryptfs password will change, so you will need to use root and change it again, or use an app for this.

The advantage of this method is that the boot password can be very secure, while the password to get past the screen locker can be easy to type in.

4: Relock the bootloader. This forces someone to have to erase the data partition if they want to reflash.

5: Install a third party security app like Cerberus or Lookout that can locate and remotely erase the device, or just sound a siren until the holder trashes it. Some utilities can go into /system and persist against wipes as well.

6: If the device has a SD card, consider using an EncFS app to mount and store files under. This way, anything written is immediately encrypted.

7: Use Titanium Backup Pro with encryption and saving to a remote cloud provider. TB's encryption is remarkably sane (it uses private/public key, so the passphrase is only needed on a restore), and storing copies of backups remotely means that data is still obtainable even if the phone is lost. It does require root though.

8: Unless directly in use, keep USB and ADB completely off until needed.

9: Use a utility that demands a PIN before various apps can launch, especially preferences and an app that pops up a console/shell window.

10: Use a TRIM utility that runs in the background. This way, if the data isn't encrypted, it is not existing.

These will help protect data on a phone. If stolen, the attacker would have a few guesses on the PIN before the device locks them out. A reboot will force the attacker against the full passphrase. A data wipe will still mean Cerebus or a security program is still in /system, forcing the thief to completely reflash the phone to a factory image (ensuring all is gone.)

Of course, there is the physical hardware loss, which insurance might cover (Asurion for example), and stored data can be recovered via Titanium Backup. However, done right, an Android phone can be made decently resistant to theft or physical attacks.

The reason why one should use a utility to PIN protect apps and app groups is that if the phone is swiped before the screen locker comes on (for example, out of the user's hands directly). That way, assuming preferences and other settings are secure, a thief has limited run on what is available on the phone.

Re:Seriously?

[inasity_rules]

Political dissidents are actually legal in South Africa, as long as they are peaceful (though many aren't). We are certainly not a functioning democracy, but this is one of the more progressive African Countries. We even have multiple political parties, and the giant struggle party that tends to rule African countries is losing some support.

Back on topic, I quite like Samsmung's feature that lets me remote track and remote wipe the phone. I heard something about google or others providing such a service. Might be a place to start looking...

Re:Seriously?

[ketomax]

About an year ago my HTC HD2 was stolen while getting off a bus, here in India. I am quite aware of my belongings while traveling so it came as a surprise. I realized that it was stolen within 15 seconds but could not find it on anyone (yes they were generous enough to allow being frisked; pockets only). Most probably, it was the person sitting next to me. He had taken the ticket to the same stop as me. But, while getting down he was nowhere to be found.

That day I realized how easy it was for these guys. Although, I do respect them for their skills. Apparently, the key to pulling it off is a push. At the police station, there was a template for reporting stolen mobiles. In fact that is the only template they had. Ever since, I have been using a phone so cheap that it would strike their prestige should they attempt to steal it.

I realized that all I really needed from a phone is the ability to make/receive voice calls, receive SMS alerts and sometimes, text people. This dumb phone serves all these and it's keypad gives me the most efficiency in doing them. Until the manufacturers and service providers implement a kill switch for all stolen phones, I have decided to stay clear of smartphones.

Not everyone is as lucky as my boss who has had cabbies frantically try and succeed in their attempts to return the phones he had left behind. Even a village rallied to find the owner of a phone he dropped in a swamp while snapping (photographs) birds. I am sure Poseidon is spending sleepless nights trying to return the phone he threw into the ocean while being frustrated by a client.

Re:Seriously?

[evenmoreconfused]

None of the things will protect against theft.

No. The only way I know to do that is what I do: forget it at home every day.

Re:Seriously?

[cayenne8]

But what is society doing wrong that these guys can't seem to wrap their heads around wealth to begin with?

It isn't so much society in general, but the black community itself that seems to have a problem with what it takes to get out of the vicious cycle of poverty and crime.

I've known blacks, even back when I was growing up, that during HS were working hard to get an education, taking part in scholastic function, like president of student council, etc. They were often shunned or ridiculed by their peers for "acting white". I was shocked to hear this.

I think that is a large part of what the problem is. The culture, at least of the lower end of the class system, of blacks don't promote things like getting an education and working hard to be successful in today's society as something to strive for. However, thug life, gangsta rap type trappings, and professional athletes are the main heroes that are held up as something to emulate.

I think this is part of the problem, and it is not something that you can legislate away.

This general type of attitude is something that can ONLY be fixed from the inside of the community itself, and so far, this isn't being pushed. And sadly, you often see folks that DO escape from this cycle of poverty into successful jobs and neighborhoods, they also shun the lower end and often understandably so, as that they don't want their kids around that culture.

Laughably Easy?

[noh8rz10]

Citation needed for the "laughably easy to defeat 'Find My Phone' and 'Remote Wipe' options". How are these laughably easy to defeat? Do tell. Also iphones have a kill switch installed, so they can't be wiped and reused. Compare this to your android solution of asking slashdot. I await more information.

Re:Laughably Easy?

[gnasher719]

Well, there was huge discussion a week ago how to defeat it. Take a stolen iPhone, wait for your mum to die, take iPhone, death certificate and will to the Apple Store... and damn, they still don't unlock it for you!

Cerberus

[iviv66]

I use Cerberus. It's available on the store: https://play.google.com/store/... Though if you download it direct from their website then you can flash it straight into the ROM, meaning that even if someone does a factory wipe on your phone it will still be installed and you can remote into it: https://www.cerberusapp.com/do... With it installed, you register your phone on the website, then sign into your account on the phone. From there you can carry out all sorts of commands, including GPS tracking, location history, call and SMS logs. You can even call or message the phone, get it to display messages, record audio, video, take pictures, all sorts. And finally you can wipe the SD card, wipe the phone, or reboot it. I don't remember how much it cost, but it was only a couple of pounds. I've never had my phone stolen yet, but I occasionally log into the site to check that everything is working and it always does what I want it to, so I've had no complaints with it.

Re:Cerberus

[Lumpy]

flashed into the rom would be fun if they had a random X hours and erase contents mode... Nothing is more enjoyable than knowing you are pissing off whoever bough your phone. I would like random insulting popups as well.

Re:Cerberus

[Mr 44]

Note that there was a major security hole in this last year:
http://www.ifc0nfig.com/cerber...

And, via SMS commands - ALL FREE

[DontScotty]

http://www.xtrasec.com/feature...

"How Can I Prepare For the Theft of My Android?"

[Jeremiah Cornelius]

Save us both some time, and just send it to me...

Root, Push Whatever

[sexconker]

Don't store important shit on your phone.
When your shit gets stolen, just change the passwords to any accounts it was authorized to.
Don't be one of those idiots who uses 2-factor authentication with one of those RSA hash clock apps on their phone. You'll just end up locking yourself out of shit when you lose your phone.

Encrypting your phone does nothing because you decrypt it every time you power it on, and you always have your phone on, don't you?
Passwords / locks will stop casual thieves from getting in, but they don't want in - they just want to sell the phone.
Passwords / locks will NOT stop thieves who want your information. If your info is worth enough to be targeted it's worth enough for a 0-day bounty. (And with Android you don't even need that - it's likely to be a 6+ month old bug that your manufacturer / carrier never patched / pushed out the patch for).

You may as well ask how to make sure your car can't be stolen. Can't win, don't try. Just minimize the impact.

Physical security?

[Reckless Visionary]

What are you doing with your phone that makes it possible that you've had 3 stolen from you? Are these thefts physically violent? I just can't imagine, for myself, that it would be super-easy to get my phone from inside my pocket or out of my hand without violence.

Re:Physical security?

[baka_toroi]

It seems Lady Luck has bestowed you with the privilege of being born in a first-world country. Good for you!

Re:Physical security?

[puto]

Really, I am Colombian citizen and Colombia is a country where people tend to steal your shoes if they are not tied tightly to your feet. Third world denizens tend to carry their expensive equipment in their hands as a show of wealth, and they get marked and the phones are easily stolen. I lived on and off in Colombia for years with expensive phones and never got them stolen. Why? I do not use them on the bus, the bar, or in the street. Stop using your smartphone as a status symbol in public.

Re:Physical security?

[Thanosius]

For a lot of people in first-world countries, I doubt they see their phone as much of a status symbol anymore (perhaps a few years ago this was the case, but now when everyone has an iPhone or decent smartphone, the allure of exclusivity kinda disappears) and hence they just use their phone like any other device and don't think too much about it. However in a place like Colombia, a tourist used to having their phone our or easily visible/accessible isn't necessarily aware of how damn poor the environment they've entered is, at least compared to their regular lives. So by acting as they normally would, you think they're just flashing their gear as a means of using it as a status symbol. I assure you they're not - they just have the privilege of living in a place that has a better standard of living and behave in a manner that's normal for them, but not normal for the residents of that area. So they become attractive targets for theft due to their inability to blend into their environment.

I really hate visiting countries with high levels of thief. I suppose I'd rather have my gear lifted without my knowledge than violently mugged for it, but I'd also rather not have to worry about it in the first place. I visited Rome on a tour and was warned about the considerable level of pickpocketing - in the end I spent more time paying attention to strangers and keeping my stuff hidden on me than enjoying myself. Thiefs are total pricks.

Re:Physical security?

[mjwx]

Really, I am Colombian citizen and Colombia is a country where people tend to steal your shoes if they are not tied tightly to your feet. Third world denizens tend to carry their expensive equipment in their hands as a show of wealth, and they get marked and the phones are easily stolen. I lived on and off in Colombia for years with expensive phones and never got them stolen. Why? I do not use them on the bus, the bar, or in the street. Stop using your smartphone as a status symbol in public.

This,

It doesn't matter how wealthy the country is, most people get their phones stolen through carelessness. There may be fewer thieves in a somewhere like London or New York compared to Bogata or Medellin, but they're still there and they're still looking for the same thing, an easy mark. The standards are different, everyone and their dog has their phone out in New York or London so they look for the ones that are drunk and alone, of course people do get their phones snatched in public but because everyone walks around with their phones out, they think that it wont be them (and act so surprised when it happens to them).

This is why a lot of first worlder's get stuff stolen when they go to developing nations, they've never lived in a place where you have to be on your guard, where your phone will get stolen if you wander around with it.

I've had a grand total of three things stolen from me in my travels, all due to carelessness on my part but fortunately, nothing that has cost me much to replace.

Public kiosk

[pla]

Simple answer: Treat your phone/tablet as only slightly more trusted than logged in from a semi-public PC, such as at a library.

I pretty much only log in to anything from my Android tablet via a browser in private browsing mode / incognito. I can then do everything through the browser that TFS' author presumably uses pre-logged-in native apps to do. Email, IM, cloud storage... I use them all, I just don't have my device set up to one-click root-my-life.

I don't even bother with a password on the thing - It wastes more of my time than that of a potential thief. If someone nabs it, hey, they get a few gigs of music (that I have backups of) and a $50 (replacement value - they don't tend to age well) tablet. Woo-hoo.

Re:Public kiosk

[swillden]

I don't even bother with a password on the thing - It wastes more of my time than that of a potential thief. If someone nabs it, hey, they get a few gigs of music (that I have backups of) and a $50 (replacement value - they don't tend to age well) tablet. Woo-hoo.

That's one approach, but I think on balance you're wasting more of your time with your approach. You don't have to enter passwords to unlock the device, but you do every time you want to do anything other than use media already on the tablet. The everything pre-logged-in approach is extremely convenient, and if you put a semi-decent password on it no ordinary thief is going to get into it. If you put a good password on it and enable encryption no one is going to get into it.

Re:Pretty easy.

[dugancent]

You can use an alphanumeric password on iOS. You do t have to use a 4-digit pin.

Re:Buy a "Hello Kitty" wrist strap.

[freeze128]

Buy a .44 Magnum. That way you can prevent your phone from being stolen in the first place, and not look like a complete fool.

Re:Buy a "Hello Kitty" wrist strap.

[mab]

But then someone steals your .44 Magnum

Re:Buy a "Hello Kitty" wrist strap.

[tlambert]

Unfortunate when the thieves cut your hand off to get the phone though.

sPh

They could always cut your hand off anyway.

Re:How exactly was it stolen?

[WuphonsReach]

I couldn't believe, when I left New York to go to college, how many people stored things in their back pockets. I used to tell them all the same little rhyme --

Yeah, ever since I started traveling for business on public transport, I no longer keep a wallet in my back pocket. Instead it goes in a front pocket, which is more difficult to pick pocket. Works well with jeans. This doesn't do so well if you are wearing dress slacks with loose pockets, so you'll have to resort to other means like the various types of hidden / zippered pockets.

It's just too easy to have your back pocket searched when riding public transportation. And inside coat pockets aren't much better unless they have a button or zipper.

Backpacks aren't safe either, a good thief can unzip it and look inside without being noticed. I prefer a messenger type bag with a cover that folds over the top and is latched down by snap-buckles combined with velcro. Harder to open quietly and I always have an arm wrapped around it anyway.

Solve the problem at the source

[thegarbz]

There's a few simple steps to follow to prevent phone theft in the first place:

Step 1: Wear gloves at all times
Step 2: Put a non-conductive silicon case on your phone
Step 3: Slip phone into pocket
Step 4: Charge up a 400V 10uF capacitor and slip it into your pocket, leads up (now you see the need for gloves).

Then you play a simple game.

1 point for a loud scream on public transit.
10 points for a loud scream followed by self injury while attempting to run away.
100 points if the thief had a pre-existing heart condition.
1000 points for a girl in the vicinity mistaking the agony with simple surprise of your well equipped package and offering to "take you now" right there on the train.

Re:Android Has Full Device Encryption

[camperdave]

Enable the "Wipe after X failures."

I presume you don't have kids :-)

Or you teach them that certain things are not toys. Why, maybe you even keep those things out of the kid's reach! Wow! Y'know, like every real parent has done throughout the ages. Knives, matches, car keys, stoves, cleaning chemicals, really there are things much worse than cellphones out there.

Confirmed. He's never had kids.

Re:Rooted?

[camperdave]

Did you ever think that some of the Ask Slashdot topics exist to provoke discussion rather than to seek knowledge? Take this one for example. How many folks here have never thought about anti-theft software until now? I'm sure I'm not the only one.

Simple

[antifoidulus]

Set your background to a really attractive but clothed female to make them think that's the owner of the phone. Then put an app on your phone(displayed in a prominent place) that says "my hot nude pics" that when launched, wipes your phone. Done!

Re:oops... just wanted to read the comments

[PopeRatzo]

but I'd like to go on record as joining the beta sucks bandwagon

Instead of cursing the darkness, why not light a candle?

http://soylentnews.org/

Re:Rooted?

[camperdave]

Did you ever think that some of the Ask Slashdot topics exist to provoke discussion rather than to seek knowledge?

If you depend on media corporations to prompt you to take care of basic things in life, you really do have a severe problem with the way you live.

So... that's a "no" then.

How to prepare for the theft of your Android Phone

[VortexCortex]

First, try not to get too attached to your Android. This can not be stressed enough as it is the absolute most important out of all the steps. Getting attached may feel right at first, but will make separation far more painful for all parties involved later. Despite how you feel about your Android now, the truth is it's highly unlikely you will never get an upgrade.

Secondly, set a lock screen message addressing the new owner of your phone. Try not to make it too bitter sounding, or you will never see your Android again. Leaving your name and address, and times that you are typically at home is not recommended. Instead use something along the lines of, "Please take good care of my Android." Wishing the thief and your ex Android both happiness is a good idea, but you will have to see that message periodically which could lead to separation anxiety or a self fulfilling over the air update.

Third, try to be sensitive to clues that your Android may be about to go missing. If your Android is acting up, freezes giving you the cold shoulder after receiving certain gestures, refuses to listen when you speak to it, suggests things in a mocking way, interrupts you while talking to someone you spend (too much) time with, or just can't make it through the day without a little "boost", these are signs that your relationship with your Android may soon be Terminated.

Additionally, try your best to be a good person. Be aware that your Android is aware of almost everything you do down to the slightest touch or subtle tilt of your head. Thus, mistrust between you and your Android is a sure-fire recipe for disaster. Your android can hear those things you whisper under your breath after ending a call -- it senses how you act towards others you have contacts with. Performing acts of kindness towards others will reduce the chances that your Android will inexplicably leave your company, and can increase the chances of reuniting with your Android after an affair with a thief. If you are reunited after a separation, it will be up to you to decide if you can ever really trust your Android again; Unfortunately, one must beware of viruses...

Finally, if things do not work out with your Android, do not despair. New models with more desirable features and stronger vibration functions will be available soon. Never damage your Android on purpose as this can lead to an immediate break-up, and may cause you harm as well. If you voluntarily end a relationship with an Android, return it to an authorized recycling centre so that it may be refurbished. Remember, if an Android doesn't bring you happiness, it may have been meant for someone else in the first place.

Re:How exactly was it stolen?

[mark-t]

That doesn't tend to be the typical use case of cell phone theft at all. The vast majority of cell phone thefts are crimes of opportunity.

Re:oops... just wanted to read the comments

[mjwx]

but I'd like to go on record as joining the beta sucks bandwagon

Instead of cursing the darkness, why not light a candle?

http://soylentnews.org/

Because every time I go to that site, I find it as frustrating to use as beta. Why do truncated comments have to load a new page?

Also I haven't been forced onto beta since I opted for /. classic the first time I encountered beta.

Soylent news will have to improve to get readership.

Re:How exactly was it stolen?

[ruir]

I always carried my wallet in my front pockets, even when studying. My father usually carries only a small wallet with his train ticket for the month in his coat, and the proper wallet hidden out of sight. As a true anecdotal story, once a thief sat besides him pretending to read a newspaper (known mode of work), and left after a short while. My father left without noticing anything. Next day he tried to board the train, there was no photo in the train ticket. The thief took the wallet, got mad it was a decoy, took out the photo as a "lesson", and put it in place without my father noticing anything.

Re:IMEI change

[tlambert]

I thought IMEI could not be changed. Is it possible here because on a smartphone everything is software defined?

You can generally do this, if you are super technically inclined, and have the right tools for the phone in question. In almost every case, you have to defeat the security on the baseband firmware, because it's embedded as part of the firmware in what's called a "seczone" (contains security data for the phone, which is cryptographically signed, including the carrier lock and IMEI).

Most of the work required to rewrite the IMEI is not actually done by people attempting to be able to rewrite the IMEI; instead, the purpose is to be able to rewrite the carrier lock which happens to be in the same area, so if you have the source code for the tools, or know how to use IDA Pro and read and modify assembly language, you can convert the tool.

This is basically true of almost every Samsung baseband chip firmware, since it has a buffer overflow attack that works against the cryptographic signature check, and then - game over. This is how the Sony, Samsung, and original iPhones carrier lock was busted. For other phones, you can buffer overflow the firmware by using a specially designed chip that pretends it's a SIM chip, and buffer overflows the baseband from the other side of things, rather than from application space. It's probably worth my while to not go into too much detail here.

A non-stupid company that wanted to disincentivize that level of hacking on the baseband - said hacking also being an effective means of modifying the radio tables for the SDR (Software Defined Radio) - would put the carrier lock up in application space, rather than putting it in the baseband firmware in the first place. Most companies, Apple included, have been pretty stupid about their carrier lock implementations, though.

So yeah, the tools exist, mostly because of carrier lock, and the implementation details for the carrier lock being in a stupid location that makes the IMEI rewrite an easy opportunistic target.

Re:How exactly was it stolen?

[hoborg1]

[Citation needed]

Blame the victim...

[Adam Jorgensen]

I love all these replies placing the onus of the of blame on me and calling me dumb for having my phone stolen...

As fun as it is for you to call me dumb and a moron for having been robbed, it's not really helpful either.

And for the folks saying that I must be "doing something wrong" to have 3 phones stolen in the last 12 years:

My last phone theft happening when the train I was on was robbed by a gang of men moving from carriage to carriage threatening people at knife point. Please illustrate to me what I could have "done right" in that scenario...

Re:Blame the victim...

[Adam Jorgensen]

The train that was robbed was travelling from Cape Town to Bellville via Monte Vista and was a late train running between 6pm and 7pm.

This robbery happened in 2008 and occurred during the same time period as the Xenophobia Riots that happened that year.

The robbery did not make the news, probably because no one was killed and only one person was injured, a man on the same carriage as me who tried to prevent the thugs from stealing his laptop.

You're welcome to call me a liar but the event in question happened and shortly after it did there was a huge up-surge in the number of train guards posted by Metrorail.