19

With the exception of the SD card data, is Android's built-in password/pin/pattern screen lock enough to protect data stored in your phone's internal storage in case of theft? Or can a thief simply by-pass this by hooking-up your phone to a PC via USB, or open the device and take the internal disk and be able to view what's inside through hacking?

As an additional question: In case remote swipe apps are not applicable, what other options can you do to protect data in your Android?

6
  • 4
    I'll just say a word about the pattern screen lock : this is not really secure. You finger contains grease that help see the pattern you make. Someone having your phone can then see the pattern an try combinations just based on the order. It's not totally useless (you can limit the number of tries) but it can be broke quite fast.
    – Cyril N.
    May 10, 2012 at 8:38
  • @cx42net Good point, I actually checked my phone and there was indeed some clues.
    – IMB
    May 10, 2012 at 9:02
  • @CyrilN. easiest method to counter that is to move your finger around in other patters after unlocking or clean the screen...
    – ewanm89
    Nov 20, 2012 at 14:44
  • @ewanm89 yup, or pass 2 times at the same place while unlocking ;)
    – Cyril N.
    Nov 21, 2012 at 9:39
  • @CyrilN Yeah, do that too, it's the first that always counts. Smudges are an issue for pin and password too though, as they can see which "keys" were pressed, just not the order.
    – ewanm89
    Nov 21, 2012 at 13:14

4 Answers 4

17

No. The pattern/PIN screen lock is not sufficient to protect the data against sophisticated attackers. However, it might be good enough in practice for most users, if the data is not super high-value.

There are two cases, depending upon whether you enable encryption of internal storage or not.

If you do not enable encryption. In this case, the data is stored on your phone's internal storage in cleartext. In principle, a sufficiently sophisticated attacker, if he has access to your phone, can likely disassemble the phone, pull out the flash chips, and read off the data. However, this requires more sophistication than an ordinary thief is likely to have. It's not as simple as just plugging in a USB cable.

So, if you're primarily concerned with garden-variety thiefs, a lock pattern or PIN might be sufficient, if the lock pattern or PIN is long and strong enough. Some caution is required, because your fingers are greasy and leave smears on the phone, which are visible later. The thief might be able to figure out your lock pattern or PIN from these smudges. See, e.g., the following research paper:

I've summarized the findings of this paper elsewhere, but the short version is that smudges are a serious threat to security, and it's hard to say for sure that you will be safe.

If you do enable encryption. If you enable encryption, then all data on internal storage is encrypted using an encryption key derived from your lock pattern or PIN. In principle, you might imagine this would provide strong security, but in practice, it has several serious shortcomings:

  • Low entropy. There's just not enough entropy in a pattern or PIN to provide a strong encryption key. Others have calculated that there is a maximum of about 400,000 possible Android dot-patterns. That's only 19 bits of entropy, which is definitely not sufficient for an encryption key. (This is probably an overestimate, because not all patterns are equally likely; the short ones are probably far more likely. This makes the actual situation even worse than these numbers would indicate.) The number of possible PINs is comparable, or even lower, depending upon the length of your PIN.

    If a sophisticated attacker gains physical access to your phone, he can likely disassemble it, extract the flash chips, and read off the encrypted data. Then, he may be able to mount a simple brute-force search that tries all 400,000 possible lock patterns, deriving a candidate decryption key from each, and seeing which one works. A 19-bit cryptographic key is not sufficient security to prevent this kind of brute-force search. So I think it would be prudent to assume that if the attacker has enough sophistication to disassemble the phone and read the flash chips, he may be able to get access to your data.

  • Smudge problems. In this scenario, the smudge attack is just as bad. If the thief can recover your unlock pattern or PIN using the smudges on your phone, then obviously the thief can gain access to all your data. See above for discussion of the smudge attack; the short version is that it's hard to say for sure that you will be safe.

Bottom line. If you just want to protect yourself from a thief who grabs your phone and runs, then an unlock pattern or PIN may be sufficient. Realistically, such a thief probably just wants a free phone of their own; they probably don't care about your data very much, or won't expend much effort to try to get to it. So, as long as there is no trivial way for them to gain access to your data, I'm guessing the average thief won't bother; they'll just reset your phone to factory defaults and then start using it.

On the other hand, if you have reason to think that you might be targeted by someone with an interest in the data on your phone, I don't think any of these methods are enough to provide strong protection. Turning on encryption helps a bit, but probably does not provide strong protection.

If you want to protect yourself from the smudge attack, you could get in the habit of wiping off the screen of your phone (this is far from perfect, but it may make the smudge attack harder or successful less often).

For more reading, see Are the iPhone “connect the dots” passwords secure?.

USB debugging. What about USB debugging, mentioned by others? Well, sure, if you enable USB debugging on your phone, then a thief who knows about this can just hook up a USB cable and dump your data. But very few end-users will ever enable USB debugging (and what fraction of ordinary street thieves are going to know about this, or bother trying it?), so this is probably not relevant to most Android users.

3
  • 1
    I'm reasonably sure Android supports full text passwords for the encryption key. I was using a custom ROM last time I tried, so it may have been a custom addition.
    – Dracs
    May 11, 2012 at 17:45
  • It does between 4 and 16 characters, certain characters aren't allowed.
    – ewanm89
    Nov 20, 2012 at 14:50
  • 2
    Also worth noting, as of 4.1 or 4.2, you have to accept usb debugging per computer via a dialog on the device. May 16, 2013 at 13:22
3

You can still install something like http://preyproject.com/ that will protect your phone in case of thief.

I was skeptic at first, but it doesn't only require to be connected to a data connection (wifi/3g) : You can also send an sms and trigger specific action like knowing where your phone is, deleting some data (like accounts, what you are asking for :)).

You should take a look ! :)

1
  • 1
    Adding a way to access your phone remotely does not sound more secure. Jun 17, 2016 at 6:55
2

If USB debugging is turned on you can start an adb shell. So you can pull files from the phone even if it's locked. If the phone is rooted you can get to application databases and configuration files (/data folders are accessible).

Just like cx42net said, if you can guess the pattern then you're in. If you can't the only way (if configured I think) is to hook it up to a pc and log in to your google account. This unlocks the phone.

EDIT

Something I forgot, but was reminded by IMB's comment. I've used this for my own applications: it would be very easy to write an app that just copies every personal file to the SD card. If USB debugging is turned on you do not need to accept any permissions if you install the app from your IDE (eclipse for instance).

7
  • Just to clarify, if USB debugging is on, a thief can gain access even if he don't know the password?
    – IMB
    May 10, 2012 at 9:13
  • yes, it's used for developers to test applications, so it can instant install stuff on there. May 10, 2012 at 9:14
  • Also, in hook it up to a pc and log in to your google account. This unlocks the phone. But that doesn't mean you can't access the files on the phone. What do you mean you can't access the files since you managed to unlock it already?
    – IMB
    May 10, 2012 at 9:14
  • I'll edit that :) May 10, 2012 at 9:17
  • "If USB debugging is turned on" - Yes, but end-user's phones almost never have USB debugging turned on. It would only be on if you turned it on, which would be a strange thing for an end-user to do. Consequently, the first paragraph of your answer is not likely to be relevant to typical users and could be misleading.
    – D.W.
    May 10, 2012 at 10:12
1

Let's not forget the power of download mode, particularly on devices that are a little to old to have a locked bootloader. Take a Galaxy S2 for example, it would take me about 5mins to put it in download mode, flash a custom kernel+recovery, reboot in recovery and delete the lock code via adb.

Of course, that wouldn't help much if you had encrypted your phone. That said, I could read the encrypted lock code in order to crack it on a more powerful computer.

Many modern phones that have been upgraded to use an encrypted bootloader also have had unencrypted or crackable versions too, for instance LG's G2 whose bootloader that came with 4.2.2 is vulnerable to loki patching. That said I don't know how you'd go about flashing an individual partition on a G2. I suppose the NSA are working on that one.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .