Freezing Android devices to break disk encryption
Posted on 18 February 2013.
Two German computer scientists have proved that it's possible to access and recover data from an encrypted Android smartphone by performing a set of simple and easily replicable steps that start with putting the phone in a freezer.

They tested the attack on Samsung Galaxy Nexus devices, which they kept "on ice" for an hour before.

Since version 4.0 of the Android platform, the device's storage is automatically encrypted and not accessible except by entering the required PIN. When the device is switched off, the data contained in its RAM chips does not instantly disappear, but fades over time (the so-called "remanence effect").

The researchers' theory was that when the switching off and rebooting of the device is performed at sub-zero temperatures, the fading of the data will be slowed down enough to allow them to access it from the phone's memory.

After pulling the device out of the freezer, they rebooted it, unlocked its bootloader, and they booted up their FROST (Forensic Recovery of Scrambled Telephones) data recovery tool, which allowed them to recover sensitive information such emails, photos, contacts, calendar entries, WiFi credentials, and eve the disk encryption key.

"If a bootloader is already unlocked before we gain access to a device, we can break disk encryption. The keys that we recover from RAM then allow us to decrypt the user partition. However, if a bootloader is locked, we need to unlock it first in order to boot FROST and the unlocking procedure wipes the user partition (but preserves RAM contents)," they shared.

"Since bootloaders of Galaxy Nexus devices are locked by default, and since we conjecture that most people do not unlock them, disk encryption can mostly not be broken in real cases. Nevertheless, in addition we integrated a brute force option that breaks disk encryption for short PINs."

"We believe that our study about Android’s encryption is important for two reasons: First, it reveals a significant security gap that users should be aware of. Since smartphones are switched off only seldom, the severity of this gap is more concerning than on PCs. Second, we provide the recovery utility FROST which allows law enforcement to recover data from encrypted smartphones comfortably," they concluded.









Spotlight

Almost 1 in 10 Android apps are now malware

Posted on 28 July 2014.  |  Cheetah Mobile Threat Research Labs analyzed trends in mobile viruses for Q1 and Q2 of 2014. Pulling 24.4 million sample files they found that 2.2 million files had viruses. This is a 153% increase from the number of infected files in 2013.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Mon, Jul 28th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //