Click to Skip Ad
Closing in...

500 million Android devices at risk: Researchers find that factory reset doesn’t completely wipe data

Published May 22nd, 2015 3:02PM EDT
Android Factory Reset

If you buy through a BGR link, we may earn an affiliate commission, helping support our expert product labs.

One of the most important things to do before selling or giving away a used smartphone is to wipe the device clean. After all, the last thing anyone wants is for a complete stranger to have access to all of their personal data. Unfortunately for Android users, researchers from Cambridge University recently discovered that performing a data wipe on Android devices doesn’t clear the device as one would expect.

DON’T MISS: Former Android diehard ‘never looking back’ after switch to iPhone 6 – find out why

Even with full-disk encryption in play, researchers found that performing a factory reset on Android smartphones isn’t always what it’s cracked up to be.

“[Researchers] found the file storing decryption keys on devices was not erased during the factory reset,” Allie Coyne reports for ITNews. “With access to that file, an attacker could recover the “crypto footer” to brute-force the user’s PIN offline and decrypt the device.”

As a result, researchers were successfully able to access data “wiped” Android devices from a wide variety of sources, including text messages, images, video, and even third-party applications. What’s more, researchers were able to “recover Google authentication tokens”, thereby enabling them to sync up any data a user had tied to Google’s services, including private emails.

The Android devices tested, which were purchased secondhand via eBay, were running Android 2.2 Froyo through Android 4.3 Jellybean. Together, devices running those particular flavors of Android account for 50.5% of all Android devices in use, this according to Google’s developer dashboard.

“The researchers estimated that 500 million Android devices may not fully wipe device disk partitions,” the report adds. “As many as 630 million phones may not wipe internal SD cards.”

Speaking to Ars Technica, Computer Scientist Kenn White said: “It’s a staggering number of devices out there that are exposed, and it’s not just somebody’s Gmail password. It’s images, photos, text, chat. It’s all these things that are private that you think if you’ve reset it you’ve reset it.”

Notably, the researchers point out that the level of risk across Android devices can vary by vendor. The full research report, titled Security Analysis of Android Factory Resets, can be viewed over here.

Yoni Heisler Contributing Writer

Yoni Heisler has been writing about Apple and the tech industry at large with over 15 years of experience. A life long expert Mac user and Apple expert, his writing has appeared in Edible Apple, Network World, MacLife, Macworld UK, and TUAW.

When not analyzing the latest happenings with Apple, Yoni enjoys catching Improv shows in Chicago, playing soccer, and cultivating new TV show addictions.