The standard data migration tools offered by major Android manufacturers such as Samsung, Google and Xiaomi pose significant security risks, as researchers from the Institute of Information Security at Graz University of Technology (TU Graz) and Zentrum für sichere Informationstechnologie (A-SIT) have revealed in a recent study. Their research revealed that critical vulnerabilities in all the tools examined allowed attackers within Wi-Fi range to spy on private user data such as call logs, photos and login details.
Security risk associated with phone cloning
So-called phone clone tools or data migration tools are designed to make it easier to switch from an old smartphone to a new device. The aim is to transfer all data, settings and apps seamlessly from the old device to the new one. These tools usually establish a direct Wi-Fi (WLAN) connection between two smartphones without the need for an external server. However, research carried out by the Graz-based IT security researchers Florian Draschbacher, Lukas Maar, Lorenz Schumm, Rene Denifl, Lukas Treffner and Stefan Mangard now shows that this convenience comes at a huge cost to security.
In all the data migration apps examined from seven Android manufacturers – Google, Samsung, Vivo, Xiaomi, Oppo, Huawei and Honor – the team found vulnerabilities that would allow them, as attackers, to manipulate the transfer or eavesdrop on it. They simply had to be within radio range of the devices – indoors, that’s around 20 to 45 metres. Using inexpensive equipment costing less than 100 euros, they were able to eavesdrop on the data transfer. Places where large numbers of new mobile phones are set up every day, such as specialist electronics shops or mobile phone shops, are particularly vulnerable to such attacks.
Digital life in the spotlight
The potential risk posed by these vulnerabilities is enormous, as almost the entire contents of a smartphone are transferred during a data migration. As part of their investigation, the researchers were not only able to access text messages, contacts and photos, but also to extract highly sensitive information such as health data, login details for saved Wi-Fi (WLAN) networks and app passwords. In some cases, it was even possible to inject malware directly into the new device via app packages that had been tampered with during the transfer.
Billions of users affected – manufacturers respond
The significance of the discovery is evident from the installation figures. The apps examined have been downloaded more than 12 billion times in total and come pre-installed on almost every Android device. “Because these apps are pre-installed and are very convenient for transferring data to a new mobile phone, these security vulnerabilities have a huge impact,” says Florian Draschbacher. The team at TU Graz had already reported the vulnerabilities to the manufacturers in advance as part of a responsible disclosure process. They had confirmed the severity of the issues (including five security alerts classified as high). All seven manufacturers have now released security updates to address the reported vulnerabilities. The researchers urge users, before migrating data between two smartphones, to “ensure that the latest version of the data migration app is installed on both devices, and to always install all relevant updates.” In some cases, this may require updating the entire operating system.
The following Android manufacturers and data transfer apps were examined:
Google Android: Android Switch
Samsung: Smart Switch
Vivo: EasyShare
Xiaomi: Mi Mover
Oppo: Clone Phone
Huawei: Phone Clone
Honor: Device Clone
