Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I recently went for a smartphone repair and got its motherboard replaced. However, it didn't occur to me to ask for the damaged motherboard back. I had confidential credentials and data stored. No doubt there is a chance the phone's storage might get copied during the repair, I'm more concerned whether the motherboard could contain any data?
(phone (Samsung note 2) had a basic password but not encrypted - should have been though)
It really depends on the device itself - without any specifics, I don't think we can really give a definite answer. I'm assuming the phone is Android, as iOS would probably be encrypted. The only real concern is any storage chips that might exist on the device.
It probably contains flash memory. Yes, unless you wiped it, confidential data will still exist on it. Usually, the operating system of the device, along with its core configuration files are stored here. This could contain anything from Wi-Fi SSIDs and passwords to SMS data.
The baseband chip is also rather likely to have cached information from the SIM card. Why? Because basebands (almost always) run proprietary software, which, in theory, could keep a copy of phone logs and SIM card information like IMSI and your phone number. However, because of the design of SIM cards, it is not possible for the baseband software (and hence an attacker) to extract the shared secrets from the SIM and clone it.
Overall, the chance of anything happening as a result is low, but it's probably worth changing your passwords. Ask the repair technician what they did with the old motherboard, and if you can get it back, dispose of it properly using thermite.
