Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I just found out that if I connect my phone to a laptop with a cable, the password becomes completely USELESS. So how can I protect the data in my phone from a usb cable?

It's actually very easy to get in my phone, because all it needs is a stupid cable. That's a bit too easy.

So how can I protect the data in my phone from a usb cable? Can I give a password to the screen that enable usb storage? Can I add password whenever I have to access the file?

How can I do that?

Tips: Pattern is pretty easy to hack, not because I know how to hack, but because if you think about the combination of the pattern password, it can only have 9^2 combinations Max (and I did calculate the patterns that cannot be used, like some that you can NOT repeat the same number)

share|improve this question
    
Much more like 9*9! than 9*9. That a 3,265,920 versus 81. –  Jeff Ferland Dec 23 '12 at 16:33

2 Answers 2

You can set PIN or password unlock, which is more secure. You can also enable phone encryption since Android 3.0. Phone encryption requires either PIN or password screen lock. SD card will not get encrypted, that has to be done separately and is not officially supported.

share|improve this answer
    
A 4-digit pin (standard on IOS and Android) has only 10000 possibilities. A pattern unlock can have over 400,000 (see my answer). –  KeithS Dec 21 '12 at 18:41
    
so in other words that it's impossible to secure the data in the sd card if you lost the phone >:|? –  user17843 Jan 19 '13 at 5:14

Actually, the maximum number of combinations an Android pass-pattern can have, given that the user must choose a pattern of at least four unique dots and can use up to all nine, is 9!+8!+7!+6!+5!+4! = 362880+40320+5040+720+120+24 = 409104 combinations, about 2^18.6. Child's play for a computer, made marginally more difficult by its being a UI-based entry scheme, and the cooldown period most Android phones have after 3 incorrect tries.

You can "lock" the SD card/SIM with a PIN that only allows it to be used in that phone by someone that has properly unlocked the phone. I'm not sure how easy/hard it is to break that layer; I would hope it's implemented via a decently-secure level of encryption.

In the worst case, Android phones support an option that wipes all data after 3-5 failed unlock attempts; if the data on the phone means more to an attacker than you, do this. Combined with encrypted phone and SD storage, this is about as safe as your phone's data will get. Most phone manufacturers and cell carriers provide offline backups; if your phone were to get wiped, you can simply restore the backup (restoration requires multi-factor authentication by providing a code they either gave you or that you gave them), and most of the things that make your phone yours are back in place. Other companies support remote wiping and/or remote bricking; report the phone as lost and the cell carrier will order the phone to factory reset and wipe the SD card, and/or to brick itself. Of course, the phone has to receive that command; you can work around it as a thief by quickly getting the battery out of the phone or putting it in Airplane mode, and then doing further work with it in a Farraday cage shielded from cell signal (It's really not as farfetched as it sounds, but it only works if the data the thief is after is on the phone itself and not somewhere the phone would give them access to).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.