9

In this month's issue of the SANS Institutes "Securing the Human" newsletter, the topic was lost and stolen cell phones. In the section on what to do if your cell phone is lost or stolen, it included this:

If you installed tracking software on your mobile device, you will most likely have the option to wipe your data. Wiping the device will erase all of your personal information from the device and eliminate the risk of your data being accessed. If your device was stolen, you may want to contact law enforcement before wiping the device and notify them that you have enabled location tracking on the device. If stolen, you should not attempt to recover your device yourself.

Personally, I don't own a smart phone because I'm paranoid. My cell makes phone calls, and that's it. I don't browse the web, and the only secure info in it is my contacts. Not that this is relevant to the question, but I include it to confess that I'm woefully ignorant in how tracking/wiping software works.

At any rate, if someone nefarious were to steal or find a lost or stolen smart-phone, wouldn't one of the first steps they'd take be to find and uninstall such software? Or is it not that easy? I'm sure it's different between the Android, iPhone, Blackberry, Windows Phones, and any others I may have missed,

But even so, I'd think a determined attacker, one who knows what he's doing would first disable such software, making such advice useless only if a clueless bad guy found or stole your mobile device.

So, basic question: How accurate is the advice? Is wiping a phone really a protection, or just another bit of advice that's better than nothing, but gives people a false sense of security?

Improve this question
4
  • 1
    You make the assumption that the type of person who steals a smartphone is smart enough to know how to wipe it of tracking software. Given that most petty thieves are typically in the low-income, low-education demographic, I wouldn't waste my time worrying about them wiping the tracking software.
    – zzzzBov
    Oct 3, 2012 at 19:58
  • Actually, I'm more worried about in a corporate setting with executives using their smartphone to email business secrets, also knowing that we've been the target of spear phishing attacks, and we've hired penetrations testers that were able to gain physical access to our secure areas where they could steal devices off people's desks. I'm mostly concerned with raising business awareness and pointing out those things that give the nm a false sense of security. (I have antivirus so I can't get infected, I use Linux so I can't get a virus (when other malware is completely possible), etc.)
    – David Stratton
    Oct 3, 2012 at 20:10
  • Good point, I should have specified that my comment was meant for a personal context. But I suppose I should have been a little more careful with my words, this being Information Security and all.
    – zzzzBov
    Oct 3, 2012 at 20:12
  • I could've included it in my question as well. No problem! I understand completely. ;-)
    – David Stratton
    Oct 3, 2012 at 20:14

4 Answers 4

Reset to default
9

There are definitely some things to keep in mind with regards to remote-wipe software, most of which you seem to have already realized.

  1. It should not be relied upon. It's definitely a great contingency to have available but, as you've stated, it's very probable that an (arguably unlikely) attacker who's more interested in your information than he is in the phone's hardware value would try to find a way to circumvent it quickly.

  2. Any remote wipe you perform will likely be after the thief has already had your phone for some time. This means it is very possible that the thief might already have copied off whatever bits of your information that they were interested in, before you performed a remote wipe. In this case, even if your wipe is successful, the data is still out there.

In short: If your phone is stolen, and you have remote wipe capability, you will want to perform the remote wipe as quickly as you realize the loss. This will help to minimize (but can never fully negate) the likelihood of actual data theft occurring. Even then, you must still presume that all the data on your phone has been leaked, and take reactive measures accordingly.

Here, I'd also like to refer you to the 10 Immutable Laws of Security, if you haven't already read them. Particularly applicable in this case, are these:

  • Law #3: "If a bad guy has unrestricted physical access to your [smartphone], it's not your [smartphone] anymore"
  • Law #10: "Technology is not a panacaea."

To answer your title question: It is indeed a valid defensive measure, but it should not on its own be at all considered comprehensive.

Improve this answer
4
  • 4
    I'd like to vote you up a thousand times for the "10 Immutable Laws" of Security link. I'm cognizant of each of the immutable laws, but that's a nice, friendly bullet list with enough information in plain language to share with non-techies. Articles for non-techies that aren't watered down are rare. That's a good one!
    – David Stratton
    Oct 3, 2012 at 15:49
  • +1. This is the essential truth behind all defensive measures: no defensive measure can eliminate risk - but good measures can help minimize it.
    – Mark Beadles
    Oct 3, 2012 at 15:57
  • 1
    @DavidStratton You may also want to read the related article, then: 10 Immutable Laws of Security Administration. Interestingly, the only duplicate between those lists is #10.
    – Iszi
    Oct 3, 2012 at 16:00
  • Also quite good. I've been actively evangelizing and explaining explaining points 1, 2, 5, 6, 8, 9, and 10 to business leaders in our company as we're working on projects together. I can't count how many times IT Security efforts are undone due to bad decisions. The goal is to get our business leaders to think about security themselves, so that they can make better decisions about risk/benefit. "Do we really need to collect this data", etc. Both of these lists are things I'm going to add to what I share. I'll go through the rest of that section of TechNet as well. Thank you.
    – David Stratton
    Oct 3, 2012 at 16:07
3

I think the point is that most phone thefts are not by determined or sophisticated attackers; they are by opportunistic theft. Consequently, phone wiping is a pragmatic way to help protect yourself if your phone should be stolen.

Can you absolutely count on it being possible to wipe your phone? No. But it's still useful nonetheless.

Improve this answer
1
  • Maybe we could create a remote explode, or catch fire option. That'll teach 'em!
    – user82913
    Jun 20, 2016 at 19:57
1

Remote wiping also comes with remote blocking, which is a community service. It will not give you your phone back, but if enough people remotely block their stolen phones, this will lower the incentive for the thief, even a tiny bit.

Phone thieves want either the phone hardware, the 24 hours of free worldwide calls, or the bank access cookies from the phone browser. Remote blocking is about depriving them of the second, remote wiping is about preventing the third.

Improve this answer
0

Yes an thief with a clue would just straight up reflash the device with factory image. Theives are rarely that sensible let alone knowing this is possible.

The wipe is separate security issue, if they are reflashing it they would wipe it anyway. The wipe is to limit the amount of time the thief has to access personal data on the device, it also has the side effect that it needs to be secure, you do not want an attacker wiping the device to deny you access to the data.

As for tracking software, in some cases it's not half bad at hiding itself using the common tricks (pretend to be system software, etc.) So manually removing is not all that easy. This however would depend on the software.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .