Hersteller-Tools betroffen: Android-Umzug: Viele Datentransfer-Apps sind unsicher

Many smartphone manufacturers, including Samsung, Google, and Xiaomi, provide tools to transfer data to a new phone. However, researchers from TU Graz and the Center for Secure Information Technologies A-SIT in Vienna discovered that attackers could potentially steal all sorts of private data, from photos to login information, within a WLAN range, due to security loopholes in the transfer apps.

The researchers found critical vulnerabilities in all seven Android transfer apps they examined: Google's Switch, Honor's Device Clone, Huawei's Phone Clone, Oppo's Clone Phone, Samsung's Smart Switch, Vivo's EasyShare, and Xiaomi's Mi Mover. Manufacturers have since released security updates, but users are advised to check the Play Store for the latest version of the respective transfer app before switching phones, and to ensure updates are installed on both devices.

In some cases, an update to the entire operating system may also be necessary. The transfer apps typically establish a direct WLAN connection between the two smartphones. Researchers found that an attacker equipped with less than $100 worth of equipment could simply need to be within the same room (roughly 20-45 meters) to intercept data - according to the study, this could include photos, contacts, SMS messages, health data, Wi-Fi passwords, and login details.

In some instances, it was also possible to smuggle malware onto the new smartphone via manipulated app packages. The researchers had reported the security vulnerabilities to the manufacturers before the study was made public.