Skip to Content
Uncategorized

CSI: Smart Phone

For criminals who use Android smartphones, irretrievably wiping incriminating information is surprisingly easy.

An international criminal mastermind being chased by Interpol has only to initiate the uninstallation of a single application on his Android phone - completion of which takes less than five seconds - in order to irretrievably wipe out all incriminating information from the device, says a new paper just unveiled at the Digital Forensic Research Conference.

The secret to this nefarious sauce is a relatively simple application that takes advantage, paradoxically, of the security built into the Android OS.

In Android, all applications are “sandboxed” so that they can’t interfere with one another, except through actions requiring that permission be granted explicitly. Within an application, a “private folder” can be created to which incriminating data from the phone is routed.

“Anti-forensics” applications can then use a feature built right into Android OS: when the application that owns one of these folders is uninstalled, the folder itself is automatically deleted.

Of course, deleting a folder off of a disk is rarely the end of the story, and often even “erased” data can be retrieved from a disk - but the internal memory is not nearly as accessible as, say, a hard drive.

In theory, a disk-level image of the phone’s internal memory would reveal the contents of such a folder, which is invisible at the OS level. But even if such an image could be obtained, the researchers say that forensic examiners would have to be able to identify the contents of the folder amidst the jumble of other information on the internal memory, which means that an invisible private folder is automatically a kind of steganography.

More importantly, to date no tools can reliably extract the full contents of a phone’s internal memory (in contrast to, for example, external storage like an SD card). As a result, the researchers’ attempts to recover data after the successful uninstallation of their own data-deletion tool, called AFDroid, were completely unsuccessful.

Here’s an image of the phone’s MMS cache before uninstallation of AFDroid.

And here’s an image of the same cache after AFDroid has been uninstalled, automatically deleting the private folder that held the phone’s critical data.

Android image cc Diarmuid Miklos

Follow Mims on Twitter or contact him via email.

Keep Reading

Most Popular

Russian servicemen take part in a military drills
Russian servicemen take part in a military drills

How a Russian cyberwar in Ukraine could ripple out globally

Soldiers and tanks may care about national borders. Cyber doesn't.

Death and Jeff Bezos
Death and Jeff Bezos

Meet Altos Labs, Silicon Valley’s latest wild bet on living forever

Funders of a deep-pocketed new "rejuvenation" startup are said to include Jeff Bezos and Yuri Milner.

conceptual illustration showing various women's faces being scanned
conceptual illustration showing various women's faces being scanned

A horrifying new AI app swaps women into porn videos with a click

Deepfake researchers have long feared the day this would arrive.

ai learning to multitask concept
ai learning to multitask concept

Meta’s new learning algorithm can teach AI to multi-task

The single technique for teaching neural networks multiple skills is a step towards general-purpose AI.

Stay connected

Illustration by Rose WongIllustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.