Slashdot Mirror
Avast Buys 20 Used Phones, Recovers 40,000 Deleted Photos
An anonymous reader writes: The used smartphone market is thriving, with many people selling their old devices on eBay or craigslist when it's time to upgrade. Unfortunately, it seems most people are really bad at wiping their phone of personal data before passing it on to a stranger. Antivirus company Avast bought 20 used Android phones off eBay, and used some basic data recovery software to reconstruct deleted files. From just those 20 phones, they pulled over 40,000 photographs, including 1,500 family pictures of children and over a thousand more.. personal pictures. They also recovered hundreds of emails and text messages, over a thousand Google searches, a completed loan application, and identity information for four of the previous owners. Only one of the phones had security software installed on it, but that phone turned out to provide the most information of all: "Hackers at Avast were able to identify the previous owner, access his Facebook page, plot his previous whereabouts through GPS coordinates, and find the names and numbers of more than a dozen of his closest contacts. What's more, the company discovered a lot about this guy's penchant for kink and a completed copy of a Sexual Harassment course — hopefully a preventative measure."
When someone says reset phone and reset data, the OS should ensure a clean wipe not a soft wipe. Should atleast fill it with 0s. And people should try to keep most of their data on sd cards and move those alongs when they get new phones.
:p.
What kind of people sell sd cards along with phone. I thought everyone are misers.
Am tempted to know what kind of nudie pics where available
Unfortunately, it seems most people are really bad at wiping their phone of personal data before passing it on to a stranger.
How many people actually have the ability to securely wipe data on their phone to start with, without rooting it? For lots of folks, the "factory reset" option is the only thing they can do on their own, and that likely only deletes prefs and network settings and erases file system directory info. It does not overwrite the bits in the phone's storage to make them unrecoverable.
Does the same thing occur with iPhones or Windows Phones or Blackberrys?
So taking out the SD card and a factory reset is not enough anymore? But how do you run DOD quality data wiping software on a phones built-in memory anyway? Most people hock phones and they are re-sold with phone numbers still on them. That should not happen. Let alone personal photos.
liberare massarum ex ignorantia, clausa descendit molestie.
> Google's Android phones flat out REFUSE to uninstall Facebook, for example.
It uninstalls just fine, thank you very much.
Or are you referring specifically to Nexus devices?
Yes, most devices we use don't actually wipe the data when you "reset to factory settings". Even desktop OSes don't do it (either by default, either at all, need special tools, etc). I bet this feature is really low on the "to do" list for most manufacturers of not only phones but also wifi routers, TVs, wireless cameras, you name it. We didn't (or maybe barely) manage to educate them not to put trivial backdoors, secure wipe is a long way out.
correct, if it's part of the manufacturer's feature set, then it's not possible to remove it, BUT, you can disable it after having removed all updates to it. Had to do that with my Sony Xperia... came with facebook and other social media rubbish... Some could be deleted, but the rest had to be disabled from starting up but still take up space.
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
That's the carrier's doing
Why do we still talk like we're in middle school? Why the code talking? "personal pictures", "manhood"? Can't we just say they found pictures of guys penises, and nude to semi-nude women?
People take nude photos of themselves, don't realize it's still on the phone, and sell the thing. The fault lies with the cell phone makers who aren't actually doing real deletes of pictures. That's just dumb. Back when storage medium was on a hard drive, and computers do a LOT of IO, deleting the reference to the file made sense to improve performance. But all phones use flash as storage, and there's simply not a lot of IO that's going on in your typical phone usage. The OS should be wiping the file, or at the very least remove the reference, and wipe the file at a later (but soon) time after (like perhaps while the user is typing something and is otherwise idle).
The reality is phones get stolen, and the data is far less secure than on a PC. The OS needs to keep up with that. Deleting data for good should mean actually deleting the data. The shortcuts that've been done in the past should be a thing of the past.
AccountKiller
This article is good reading in itself but it wound up being an advert for the poster's product. I wonder how much Dice got paid to post this "story"? Is it any wonder I spend more time over at soylentnews.org, the name of which I was going to bury in a link but couldn't because the link gets replaced with "slashdot.org"?
It's really quite a simple choice: Life, Death, or Los Angeles.
fb pays the carrier or does some favors.
look into "facebook zero", they do direct collaboration with the operators to enable zero fee(to user) facebook access..
world was created 5 seconds before this post as it is.
My phone didn't even have the Facebook app installed when I bought it.
It still doesn't.
Nope... Apple iPhones actually securely erases the encryption keys which renders the contents of the storage useless.
It's a big button called "Erase All Contents and Settings". It does precisely that.
So no one knows you had the Grinder app installed?
By the time it is old it is worthless. Just smash it up and throw it in the river.
They could have filled out the loan application somewhere else and uploaded it to a service like Dropbox. Viewing it later on the phone would leave a cached copy on the phone.
They have circumvented a protection measure, that is wiping the phone- a faulty protection measure, but that doesn't matter, as history taught us if you find holes and publicize them, no matter the responsibility of the manufacturer, you are terrorist!
Moreover, it is clear they have an interest in selling their own protection products, and that they have given bad ideas to people who normally would have started using the second hand phone and overwriting the crap with their own crap.
So why doesn't avast end up in trouble like $RANDOM_HACKER ? Huh?
---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
You mean like an iPhone? (as stated several times elsewhere on this thread).
Well no, it doesn't. You've contradicted yourself. What iOS does is delete the encryption key, as you stated, which renders the data inaccessible without recovering the key. The data is still entirely intact; Just really, really hard to recover :)
Finally had enough. Come see us over at https://soylentnews.org/
How is this not a violation of the Computer Fraud and Abuse Act (CFAA)? They bypassed security measures (deletion) to access someone else's personal information without authorization. Given how broadly this has been interpreted in the past (Andrew Auernheimer was prosecuted for visiting public URLs on the Internet), Avast's act clearly should be considered a violation. Or is this a case of "if a corporation does it, it is not illegal"?