Data and Account security on Android phone in case of it being stolen

Question

How secure are Android smartphones when someone gets physical access to the phone, in other words, someone stealing my phone and how to improve this security?

I'm especially worried about all the accounts that I am logged into on my phone such as my google account, and my bank account which solely uses my fingerprint as login verification.

On Windows, I use full disk encryption with a pre-boot password. The pre-boot password is necessary in order to prevent a cold-boot attack/DMA attack in case an attacker gets physical access to my computer. Also, I'm very aware of the fact that my data on my Windows laptop is not secure if Windows is already running when the thief gets a hold of it, even if the lock screen is activated. However, other than a laptop, I usually never turn my phone completely off. Usually, my phone is always turned on and I would just use the lock screen when not using it. Completely turning the phone offline dozens of times a day would be very impracticable. This however seems to be very insecure, since even if I used device encryption the decryption key has to be somewhere in memory, ready to be accessed by everyone who steals my phone, right?

Also, I'm using an Honor View 20 phone, which seems to not have the functionality of encrypting my phone. There is just an option to "enable the data safe" which seems to only encrypt some of my personal files, but not the entire device. Unfortunately, it doesn't tell me exactly.

I'm very worried about the security of my personal data and especially the accounts that I'm logged into on my phone in case of it being stolen.

How secure is my data on an Android phone in such a case, when I'm just using the regular lock screen and fingerprint ID? Can the Android lock screen somehow be bypassed? And can I somehow get my phone just as secure as I can get a modern Windows laptop with a TPM Chip, enabled device encryption via Bitlocker and a pre-boot password?

Answer 1

All modern android devices have File Based Encryption from first boot of the device.

There are 2 states a device can be in:

1. After First Unlock (AFU) State

   This is the state your device lives in most of the time when it has been unlocked at least once after reboot.

2. Before First Unlock (BFU) State

   The is the state when the device is rebooted or is powered on but it has not been unlocked yet. In this state, biometric lock does not work. The device awaits for screen lock code to decrypt data.

Attack Against After First Unlock State

As long as your device is in AFU state but is locked, it is exposed to some attacks that can be carried out at locked screen:

1. The attacker can read app notifications which are by default show up at locked screen. This includes OTPs via emails.
2. He can make small NFC enabled payments that does not require unlocked screen.

Below points require technical expertise and even that does not guarantee "quick success".

3. The attacker can clone your fingerprint from the device surface to unlock the device and your personal data can now be transferred to PC.

4. A critical severity exploit that can be executed from locked screen can not only bypass the lock screen protection but can also exfiltrate data from your device even if the device uses encryption. This is because, the payload can request the kernel to decrypt the data for it and exfiltrate it via Bluetooth or wifi.

Attack Against BFU State

BFU state is more secure than AFU because the necessary data encryption keys cannot be derived without screen lock code. The key derivation and screen lock authentication are backed by Trusted Execution Environment (TEE) so the attacker has to use a critical exploit for TEE that can be executed at locked screen and can bypass TEE cooldown limits for invalid screen lock attempts. Then only the brute force attack to find the correct password will work.

As you will have to reboot the device after every use to put it back in BFU state, it is impractical to achieve. But it is also impractical for an average attacker to take advantage of AFU state. Without an ideal exploit, a locked device is as secure as BFU. A minimum data security practices like using long password or code instead of pattern and avoiding biometric lock can make it infeasible for an attacker to unlock your device or access its data.

Answer 2

No device will ever be 100% secure. You got to consider your personal risks. Are you a target of highly sophisticated hackers / state backed personnel? Then your risk is relatively higher compared to the risk of having your phone stolen by some person in need of money at the airport / train station / etc.

Your device is sufficiently new, so it should have file based encryption turned on by default without the option to turn it on or off. There is no simple known way I am aware of to circumvent the PIN prompt on Android. When you boot your device, you have to supply the PIN code. Only after the correct code is entered, the phone starts to work as intended (notifications / apps / unlock by fingerprint). In this regard it is in fact similar to Windows.

Yes, this means the decryption keys are in memory. But the cold boot attack you are mentioning isn't as dangerous in my humble opinion. That's because you have to consider the constraints of a mobile phone. Imagine you are the attacker, there is no straightforward "opening up the device to extract the memory", the phone is glued together. Now you say hey that's not a true problem I can break it apart, then comes the next one: The RAM is soldered onto the SoC. So you can't just spray the RAM with liquid nitrogen, take it out and into another machine to get the memory dump. Want to unsolder & resolder the RAM? That's going to be very hot near the RAM, and as you might be aware the information fades more and more away the warmer the RAM is.

Well, then leave the RAM in and reboot from a research OS? Not that simple. For one, Android is much more resilient against those attacks because it's just an utterly mess of different devices requiring different drivers. So the research OS for your dump has to target the Kirin 980 chipset and include the proper software for your device. Got the research OS in handy? Last part is you have to mess up the Verified Boot protection, which prevents the execution of unsigned code at boot time. But hey, now you got choices: Either search for a bug to circumvent the Verified Boot protection, or break in at Huawei Headquarters to take their key and sign your research OS. I could continue but I guess you are now aware this is not "ready to be accessed", let alone for some usual thief stealing phones for a living.

Because you use the phone that often, turning it off is not an option. Then I'd say your accounts are safe, because you will notice the missing phone quite quickly and have enough time to log you off via another device from your Google account, other accounts and arrange with your bank to lock down access from the lost phone. The "data safe" is a file vault app from Honor, it's basically an app which stores your media files in the private app data directory, inaccessible to the your file manager and other apps. But it is not related to full device encryption.

You may also leave WiFi / mobile data on at all times and attempt to remotely locate / erase the device via Google Find My Device.