The IT Nerd

The BBC is reporting that there’s a flaw in Android that could leave you open to having your device taken over or your credit card info swiped. It was discovered by a company called BlueBox Labs and here’s a description of the flaw:

BlueBox has dubbed the vulnerability Fake ID, because it exploits a problem with the way Android handles the digital IDs – known as certification signatures – used to verify that certain apps are what they appear to be.

The issue is that while Android checks an app has the right ID before granting it special privileges, it fails to double-check that the certification signature involved was properly issued and not forged.

Jeff Forristal, chief technology officer of BlueBox, likened the issue to a tradesman arriving at a building, presenting his ID to a security guard and being given special access to its infrastructure without a phone call being made to the tradesman’s employer to check he is really on its books.

“That missing link of confirmation is really where this problem stems,” he told the BBC.

“The fundamental problem is simply that Android doesn’t verify any claims regarding if one identity is related to another identity.”

To make matters worse, he added, a single app can carry several fake identities at once, allowing it to carry out multiple attacks.

That’s not good. But what is worse is that while Google has fixed this, Android users will have to wait for the Samsungs and HTCs of the world to push updates down to them via their mobile phone operators. That could take months which means if you’re running Android 2.1 to Android 4.3, you are potentially open to attack. Thus the only way at present to protect yourself is to use an app from BlueBox to see if you’ve been affected by this.

Security company AVAST decided to do a research experiment. They bought 20 phones from eBay that had been wiped. Here’s what they found:

• More than 40,000 stored photos
• More than 1,500 family photos of children
• More than 750 photos of women in various stages of undress
• More than 250 selfies of what appear to be the previous owner’s manhood
• More than 1,000 Google searches
• More than 750 emails and text messages
• More than 250 contact names and email addresses
• Four previous owners’ identities
• One completed loan application

One phone even had a competitor’s security software installed, but unfortunately it did not help the former owner as it revealed the most personal information out of all the phones we analyzed. 

Translation: Wiping your phone doesn’t erase the data if you know how to get it back. Now the company does of course suggest that you use their software to wipe the contents of the phone. But you don’t have to do go that route. Instead, you can follow these instructions from Lifehacker that are not only for Android, but for iOS as well. Either way, you now have proof positive that you need to take additional steps to wipe your data clean from the phone that you plan to sell.