full-disclosure - Re: Android wipe unreliable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAH8yC8mAE8pao9m6TMTTZ4vBu2BRBBE_faV2OL4whUT-DNEqiw@mail.gmail.com>
Date: Sun, 18 Mar 2012 21:05:29 -0400
From: Jeffrey Walton <noloader@...il.com>
To: Jan Schejbal <jan.mailinglisten@...glemail.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Android wipe unreliable

On Sun, Mar 18, 2012 at 1:46 PM, Jan Schejbal
<jan.mailinglisten@...glemail.com> wrote:
> We have discovered that the "wipe" function on Android does not reliably
> delete data on all devices. On a Nexus S running Android 2.3.6, we were
> able to recover user data after running a "wipe" both using the "factory
> data reset" from the menu and by wiping the device from recovery.
I'm not sure there's anything new here :)
> ...
>
> This means that if a locked device affected by this is lost/stolen, it
> is possible to access the data by first wiping the device (to remove the
> screen lock), then rooting and recovering.
If you think remotely wiping Android is bad, try and iOS device.

> Note that we do not know the full range of affected devices.
> Manufacturers may have made customizations that fix this, and Android
> 3.x and 4.x (Honeycomb/ICS, about 5% of devices) seem to have fixes
> according to the code.
Probably most of them.

> The Android security team has been notified.
Reliably Erasing Data From Flash-Based Solid State Drives,
www.usenix.org/event/fast11/tech/full_papers/Wei.pdf.

You might want to open a discussion on Android Security Discussions,
http://groups.google.com/group/android-security-discuss.

Jeff

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/