Data Transfer App Flaws Expose Phone Secrets: Passwords and Images at Risk

Researchers from Graz University of Technology in Austria have revealed widespread security vulnerabilities in applications used for transferring data on Android phones.

The researchers stated that the flaws affected data transfer apps provided by seven major smartphone manufacturers running the Android system: Google, Samsung, Xiaomi, Oppo, Vivo, Huawei, and Honor. This makes the issue extensive given the global prevalence of these companies' devices.

The research team, which included experts from the Institute for Information Security at Graz University and the Austrian Center for Secure IT, explained that attackers could exploit some of these vulnerabilities simply by being within range of the Wi-Fi connection used during data transfer, without needing physical access to the phone.

External Servers

The severity of these vulnerabilities lies in their targeting of one of the most sensitive operations in smartphone usage. The process of migrating to a new device involves transferring photos, messages, contacts, apps, personal settings, and sometimes login credentials and health data stored on the old device.

Data transfer tools, sometimes known as phone cloning apps, rely on establishing a direct wireless connection between the two phones, allowing information to move without external servers. Despite the speed and ease of this method, results showed that direct connection alone does not guarantee protection against data interception.

The researchers tested seven apps, including Android Switch from Google, Smart Switch from Samsung, Mi Mover from Xiaomi, Clone Phone from Oppo, EasyShare from Vivo, Phone Clone from Huawei, and Device Clone from Honor, discovering security weaknesses in all examined tools.

Experiments demonstrated the possibility of intercepting information exchanged between the two phones from a distance ranging between 20 and 45 meters inside buildings. This distance could allow someone in an adjacent store or nearby room to spy on the data transfer process without the user noticing their presence.

Notably, executing the test attacks did not require advanced equipment; the researchers used setups costing less than 100 euros, indicating that exploiting these vulnerabilities is not necessarily limited to entities with massive technical or financial resources.

During tests, the team was able to access text messages, call logs, contacts, and photos, along with more sensitive information, including health data, app passwords, and saved Wi-Fi network credentials on the phones.

The problem was not limited to spying and information theft; the research also revealed the possibility of injecting malicious software in some cases during the migration process by manipulating transferred application packages, potentially compromising the new phone during its initial setup phase.

The team warned that mobile phone stores and electronics retail centers may be among the places most exposed to these risks, due to the frequent execution of data transfers there and the presence of numerous devices and users in confined spaces.

Security Vulnerabilities

Florian Draschbacher, co-author of the study and researcher at the Institute for Information Security at Graz University, said that the wide distribution of these apps, their pre-installation on phones, and their ease of use make the potential impact of the vulnerabilities significant.

The researchers noted that the analyzed apps had exceeded 12 billion total downloads, with many pre-installed on Android devices, reflecting the broad reach of the affected tools, though this does not mean this number of users were compromised.

The findings were part of research presented at the European Conference on Computer and Information Security Research in Rome, revealing security vulnerabilities, five of which were classified as high severity.

The scientists informed the seven companies of the examination results before public disclosure, following responsible vulnerability disclosure mechanisms that give developers a chance to address security issues before details are published.

The researchers confirmed that the seven companies had already issued security updates to address the discovered vulnerabilities, meaning the results do not prove that all current versions of the apps remain vulnerable to hacking.

The researchers advised smartphone users to ensure they update data transfer apps on both the old and new devices before starting the migration process, noting that some fixes may require updating the entire operating system.

The results highlight security risks that users may overlook when changing phones, confirming that relying solely on official apps is not enough to guarantee the protection of personal information unless they are equipped with the latest security updates.