Two German computer scientists have proved that it's possible to access and recover data from an encrypted Android smartphone by performing a set of simple and easily replicable steps that start with putting the phone in a freezer.

They tested the attack on Samsung Galaxy Nexus devices, which they kept "on ice" for an hour before.

Since version 4.0 of the Android platform, the device's storage is automatically encrypted and not accessible except by entering the required PIN. When the device is switched off, the data contained in its RAM chips does not instantly disappear, but fades over time (the so-called "remanence effect").

The researchers' theory was that when the switching off and rebooting of the device is performed at sub-zero temperatures, the fading of the data will be slowed down enough to allow them to access it from the phone's memory.

After pulling the device out of the freezer, they rebooted it, unlocked its bootloader, and they booted up their FROST (Forensic Recovery of Scrambled Telephones) data recovery tool, which allowed them to recover sensitive information such emails, photos, contacts, calendar entries, WiFi credentials, and eve the disk encryption key.

"If a bootloader is already unlocked before we gain access to a device, we can break disk encryption. The keys that we recover from RAM then allow us to decrypt the user partition. However, if a bootloader is locked, we need to unlock it first in order to boot FROST and the unlocking procedure wipes the user partition (but preserves RAM contents)," they shared.

"Since bootloaders of Galaxy Nexus devices are locked by default, and since we conjecture that most people do not unlock them, disk encryption can mostly not be broken in real cases. Nevertheless, in addition we integrated a brute force option that breaks disk encryption for short PINs."

"We believe that our study about Android’s encryption is important for two reasons: First, it reveals a significant security gap that users should be aware of. Since smartphones are switched off only seldom, the severity of this gap is more concerning than on PCs. Second, we provide the recovery utility FROST which allows law enforcement to recover data from encrypted smartphones comfortably," they concluded.



Follow @zeljkazorz