How secure is an offline android phone?

Some background. I want to use an app called Bither on android, which allows me to create a cold wallet on 1 phone and a hot wallet on another phone.

Cold wallet is a wallet which is created on a computer which never connects to the outside world.

Hot wallet is a wallet which is created on a computer which does connect to the outside world.

Assuming that I keep the offline phone in a secure safe, switched off, and only take it out of the safe and switch it on when I want to sign a transaction.

Even if I remove the sim card, is it possible for someone to get access to the data in the offline phone without physically having access to the phone, even if the phone is switched off and the battery is removed?

  • 4
    When you use the phone, does it need to connect to the outside world? E.g. do you re-insert the SIM to allow for data transfer of any kind? Clearly no-one can access data on a switched off, battery-less phone in a safe, but existing malware on the phone may do something the moment connectivity is possible. – Duncan Jones Nov 12 '14 at 13:14
  • A SIM card will never be inserted into the phone when the phone is used. To use the software in the phone, it will be SIMless, and the app will simply generate a qr code for another phone to scan in to complete a transaction. – oshirowanen Nov 12 '14 at 13:58

Removing the SIM alone wouldn't prevent a remote hack if the phone was powered up as WiFi would still be available and therefore an attack vector. However, a phone that is off with no source of power is not remotely hackable. At least there's no demonstrated techniques or even published research that I know of which would make it possible. Without a power source there's no CPU or antenna operation, it's just a sophisticated brick.

The thing is that in order for this cold wallet to be useful it will need to talk to something - as some point you will need to turn this on and connect and then it's just as vulnerable as anything else. Android is designed as a vehicle to get your personal information to the outside world so is chatty by default, however there are some Android ROMs which are designed with security in mind, it would be best if you installed one of those and limited the operation of your cold wallet phone to the bare essentials.

  • When I do switch the phone on, it will be simless, and it doesn't need any wireless connections. The software in the phone will generate a qr code which will be scanned in by a different phone to complete the transaction. Unless ofcourse switching the phone on automatically starts broadcasting some sort of signal which I am unaware of? – oshirowanen Nov 12 '14 at 14:00
  • It shouldn't if you have airplane mode turned on. – GdD Nov 12 '14 at 14:03
  • Is it possible to switch android on with airplane mode enabled by default? – oshirowanen Nov 12 '14 at 14:39
  • I don't know about by default, however if it was shut down in airplane mode it will start in airplane mode, that's by design. – GdD Nov 12 '14 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.