Cell Phone Secrets Die Hard 146
duplo1 writes "According to an article on CNN, "Selling your old phone once you upgrade to a fancier model can be like handing over your diaries. All sorts of sensitive information pile[s] up inside our cell phones, and deleting it may be more difficult than you think." It seems that corporate security policies need to extend their disposal standards to mobile devices; but what is there to educate consumers regarding such a potential breach of privacy?"
factory reset? (Score:3, Interesting)
Re:factory reset? (Score:5, Informative)
But that's just the typical reset. Factory Reset isn't a feature that is normally exposed without additional external attachments (a cable, a PC, and special software).
Re: (Score:3, Informative)
Re: (Score:2, Informative)
Re: (Score:3, Interesting)
Why even try to sell a phone that is so last years model?
If you're on a plan, you get free phones and if you're on a pre-pay, those phones are only good for that plan.
Re:factory reset? (Score:4, Insightful)
Once you're month-to-month (which normally happens at the end of your plan) you may wish to get a new phone without being locked in for an additional year or two. You can get this year's model on eBay if you really need it, but why bother? Get last year's model for $40 and you've got the freedom of a pay as you go plan but with a much better phone and more predictable monthly costs. It's the best elements of a plan without the contract.
--Pat
Re: (Score:2)
Re:factory reset? (Score:5, Informative)
Not true. If a phone has been unlocked [thetravelinsider.info] for $10 or so, it can be used on any compatible network. Meaning I could eBay a Cingular phone and use it with T-Mobile-To-Go and pay by the month.
Furthermore, for $75 I could eBay a used Motorola V330 that had been used with a T-Mobile 2-year contract. Then I could use it with T-Mobile-To-Go. I'd get a good phone for a great price that is more capable than the Samsung SGH-209. T-Mobile sells that one new for $99.
I happened to be researching them last week before buying.
Re: (Score:2)
Re: (Score:3, Insightful)
Personally I think this is where the government could do some good by putting a regulation in place. This would futher force cell providers to compete more, since you don't lose the inventment of your phone. Phone prices would also likely drop, as you can now use some phones that were not available before on say Verizon.
I think prices are kept artifically high now, just so they can g
Re:factory reset? (Score:5, Interesting)
Re: (Score:2)
THey won't get much from mine... (Score:5, Funny)
Re: (Score:2)
And I didn't get my phone like the Sidekick girl in New York, I got it as a gift. A real gift, not the kind found in the back of a taxi.
Re: (Score:2, Funny)
omg u g01n 2 da m0vi tonyt?
may b i hav 2 get f00d b 4 tho
ok ttyl
cya
Re:I can tell you've never had a cell phone. (Score:4, Informative)
What's the point? (Score:5, Funny)
Re: (Score:3, Funny)
No trust for the Bells, that's for sure. (Score:5, Interesting)
Even if you take preventive measures to erase sensitive data from devices, you still have mega-corporations who accidentally release sensitive data like a good smelly fart.
Even when they don't release it publically, they lack both the competence or will to keep it to themselves. I remember, ten years ago, an acquaintance who taunted a friend with private medical information. She had been a clerk for a debt collection agency and used her access to look up all of her friends. The big dumb companies share things they should not and don't keep tabs on it. Imagine what clerks at ChoicePoint could do, then think of how owned their little windoze terminals are. There's not much real privacy left anymore.
Cell phones are not free platforms and the owners are some of the most notorious abusers of personal privacy. Almost all of the Baby Bells were too happy to comply when the Bush administration asked them to break the law and tap their customers. Just to get a Cigular phone six years ago, I had to give the creeps monthly access to my credit record! You have to remember that the parent company at one time refused to allow people to plug modems into their network. The babies continue to stonewall broadband to this day. They will do anything and everything to get some crummy little franchises over their users. Your "secrets" are the last of their concerns, except where it can be used for their own marketing purposes.
My answer kind of sucks, but it works. My cell phone is nothing more. I put names into it because the phone company already knows who I'm talking to. Nothing else goes in. I don't SMS, I will never use their calenders. I resent GPS tracking. I'll never trust their cameras and I'll keep it in a box if I'm ever talking about something sensitive. The damn thing is like a bug in my pocket that can be abused by anyone with the technical wherewithal to pull the wool over the Baby Bells. These days, that's about anyone.
Re: (Score:3, Funny)
Even when they don't release it publically, they lack both the competence or will to keep it to themselves.
That's funny - my wife says the same thing about me farting and I'm not even a corporation!
Ugh! Another day, another leak. (Score:2)
So I was just talking about big dumb companies not being able to keep data they should not have in the first place? ATT loses credit card data [bbc.co.uk]. That's information they actually need. Do you think they care about your email, besides keeping it for the NSA? Stooges.
Re: (Score:3, Insightful)
Re: (Score:2)
If this is true, and in the US, your friend can sue and easily win as sharing medical data is a HIPPA violation
It was billing information. Today that information might not have as many details but it did then. At the time there was no HIPPA.
easy fix (Score:5, Funny)
Re: (Score:3, Funny)
Re: (Score:2, Funny)
People sell their phones? (Score:2, Funny)
Re: (Score:1)
Common Sense? (Score:2, Informative)
Common sense? When a big organisation gets rid of it's old computers it (usually) destroys the harddisks totally. Why should it be any different with mobile phones?
In a previous organisation that I worked for, the IT department (who happened to be in charge of all things cellular) made sure that every outgoing phone went through it's hands before going back to the cell operator for an upgrade or onselling etc.
The only
Re: (Score:3, Interesting)
I disagree. The problem is not limited to devices provided by an employer. Employees are likely to put confidential company information on their personal PDAs, just as they do on their home computers. Most of them let confidential information leak simply because they weren't aware
Re: (Score:3, Insightful)
And TFA recommends you should physically destroy your old phones. All very convenient for the phone manufacturers, no competition from the secondhand market. Not to mention the toxic electronic waste. And the phone manufacturers don't provide a simple "wipe/overwrite/wipe command, for fear some idiot will use it unintentionally and complain, or
What's the point (Score:2, Funny)
Re: (Score:3, Interesting)
Well, $20 is $20. If it works, you'll get at least that much on eBay. heck, I've sold no-frills phones that were 3-4 years old for $50 on ebay.
Smartphones, the ones most likley to carry sensitive data, cost hundreds of dollars new, so selling one that is several years old can still get you $100-300 depending on popularity of the model -- particularly since service providers frequently update models with useles
Re: (Score:1)
LOL...the folks who bought them were probably hoping to harvest YOUR old data!
Re: (Score:1, Offtopic)
Re: (Score:2)
In my company... (Score:5, Funny)
Re:In my company... (Score:4, Funny)
Your company hired Gallagher [wikipedia.org]?
Re: (Score:3, Funny)
If you were really serious about security, you'd then smash the gentlman to bits. Who knows what he learned while handling it?
Re: (Score:1)
Here at Acme, we also smash the gentleman who smashed the gentleman to bits. This day in age, you never know how information can travel, with bribery and all...
Re: (Score:2)
Re: (Score:3, Interesting)
4033 Industrial Shredder
The Ultimate in Central Shredding Systems. Designed to be versatile to work as a stand alone destruction unit or in combination with a disintegrator for maximum size reduction. The Model 4033 shredder is capable of destroying bulk product from roll stock to whole computer towers into pieces 2" wide at random lengths. Add a disintegrator to achieve particle sizes to meet DoD requirements.
Disintigrator description:
Waste material is fed into the machine
Re: (Score:1)
What kind of home is going to spend ~$5000 on an anything-shredder?
Re: (Score:3, Funny)
Re: (Score:2)
Some carriers handle this properly (Score:5, Informative)
Greed, not paranoia (Score:3, Informative)
Of course, I haven't actually seen the schematics for any (much less all) of the DoCoMo phones so I could theoretically be being fooled, but given the nearly paranoid attitude among Japanese these days over personal information, I doubt DoCoMo would take that risk.
I think greed has more to do with it than anything else; by destroying the phone instead of reselling/recycling/donating it, they protect the market for new phones. If people sold their phones instead of tossing them or letting them be destroy
Re: (Score:1)
Re: (Score:1)
The problem is that a single hole punch in the middle of the phone may or may not do anything. As you mentioned, it depends on the schematics of the phone, and some PCBs have memory one place while other PCBs place the flash somewhere else.
There are actually two memory areas in your DoCoMo phone. The first is the SIM card itself which can hold a handful of data. The other is onboard NANDFlash (or some similar Flash mem
Re: (Score:2)
There is at least one motorola phone which has software developed by Motorola. But the external interface (i.e. how it talks to the network, how it talks to things that plug into it etc) is done to a DoCoMo spec (AFAIK, I dont own one and havent seen one so I cant say for sure)
Re: (Score:1)
Re: (Score:2)
I dont own one and cant say for sure but I believe that both run the same Motorola software as other motorola phones but modified to "speak DoCoMo" (as it were)
Bah (Score:5, Insightful)
That said, i remember the good old days, when you didn't loan out your floppies without running a wipe program on them... otherwise the boys found your 'secret stash' that you just deleted.
Re: (Score:2, Funny)
Re: (Score:3, Insightful)
Personally, I think 99% of the negligence belongs with the consumer who is trying to eek a few pennies out of their old phone.
Re: (Score:2)
The problem with that is that the "Free market society" only applies to features that the general consumer can easily see and readily appreciate. For instance, no-one that I know of has made great leaps in the marketplace just by having their car where the gaskets wear out in 100,000KM instead of 90,000... but that doesn't
Re: (Score:2)
Re: (Score:2)
Spoke too soon (Score:2)
Uh, an AP news release on CNN.com. Did you think this wouldn't make it out at the time of the interview? Idiot. Expect prices on used phones to spike a bit on feeBay over the next few days. The bad guys, even the technophobic lazy slobs, all know now, thanks to you. Thanks, guys!
Re: (Score:2)
Conflicting reports (Score:2, Interesting)
As posted to the internet just last month:
"A police digital forensics expert has admitted that some mobile phones are impenetrable to software used by police in forensic examinations. The revelation follows a paper by a Cambridge researcher which originally made the claim."
http://www.theregister.co.uk/2006/07/07/mobile_pho ne_forensics_barrier/ [theregister.co.uk]
Re: (Score:2, Informative)
"Mansell pointed out that time-consuming manual examination can still retrieve phone data."
All they're saying is that non-standard formats make it harder to lift information - it's still there. Just like it's harder to recover lost data on ReiserFS than it is on ext2. It's still there, but the filesystem makes it a little more confusing.
Anyway, this should become less of a problem as manufacturers settle on a few standard formats to cut costs.
once erased, it can also come back.. (Score:5, Interesting)
I have no idea what any of the xrays were trying to show me, but he seemed pretty concerned about some spots in a couple of them. I thought it was cool I could zoom in on them with my phone. Man I hope copies are being kept on the server...
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
A friend of mine... (Score:1)
NIST review of available tools: (Score:2, Informative)
"This report gives an overview of current forensic software, designed for acquisition, examination, and reporting of data discovered on cellular handheld devices, and an understanding of their capabilities and limitations."
http://csrc.nist.gov/publications/nistir/nistir-7
Funny story... (Score:3, Interesting)
I always wondered what would have happened if I had called those people in the phone's memory to try to find out who's phone I had.
Re: (Score:2)
big deal.. (Score:3, Funny)
What a surprise, Delete doesnt Delete (Score:5, Insightful)
But anyway, who in their right mind would put sensitive information on a medium that its user can lose control over? (Lets overlook the computers that the government has been misplacing with everyones social security numbers for a split second) You (generally) wouldnt let someone use your computer if it has information that you do not want them to see, why should a cellular telephone be any different.
Next thing you know someone will be surprised at the ability to intercept bluetooth. Someone will be transmitting sensitive information via bluetooth and some buck tooth 14 year old will be around the corner to intercept it...
In closing, since people did not know that their data does not necessarially go away, did you know that if you do not secure a wireless router, people can potentially intercept information?
Its a pity you cannot legislate stupidity...
Re: (Score:2)
Bluetooth interception: impossible! (Score:2)
In my mighty Samsung A640's user manual, the bluetooth section takes all of 1 page. Just enough to tell you how to turn it on and change the device name. Just like the GPS feature: it makes a little icon light up on the screen, no more.
Proper cell phone design... (Score:3, Insightful)
-b.
Re: (Score:2)
-b.
duh? (Score:2)
Same non free problem desktops have, times 10. (Score:2)
This is the same problem companies had with old hard drives from their employee's computers both at work and at home. People give away or sell their old equipment and with it go their "secrets". Of course, the more important pieces of information were already snooped by industrial espionage, given the sorry state of security on the dominant software platform. Keyloggers abound and employees have been sending things unencrypted all along.
Non free "smart" phones exasperate the problem because they are e
Some people don't even care... (Score:2)
Check out mobile phone companies' wrongdoing (Score:1)
I thought we were supposed to be nerds (Score:2, Interesting)
Re: (Score:2)
Resetting Palm? (Score:3, Interesting)
"Palm Inc., which makes the popular Treo phones, puts directions deep within its Web site for what it calls a "zero out reset." It involves holding down three buttons simultaneously while pressing a fourth tiny button on the back of the phone.
But it's so awkward to do that even Palm says it may take two people. A Palm executive, Joe Fabris, said the company made the process deliberately clumsy because it doesn't want customers accidentally erasing their information."
They haven't seen kungfoo of emacs users 5 keys to a command
2c
Re: (Score:2, Informative)
both right (Score:2)
Blueberry Blues (Score:2, Informative)
Smart phones vs. Phones (Score:2)
All the references for "recovered data" seems to come from "smart phones". They specifically mention a Treo and a Blackberry. These are basically handheld computers that happen to include a phone. They store large amounts of data in addition to phone records, so they'll also have measures to prevent accidental erasure that would lose more than just old caller ID records.
But the AP weanies who wrote the article are clueless and just calls them
Why sell? (Score:3, Insightful)
Re: (Score:2)
There is.. (Score:2)
Check the warnings in the manual (Score:2)
Need legislation (Score:2)
Now, it's not at all hard to implement a "FORGET ALL" functionality: all you have to do is overwrite the entire memory with any combination of ones and zeros that doesn't represent the stored data, and if you need more than 5
Stupid Article (Score:2)
When have you ever seen a phone without a master reset feature? I know I never have.
They even point this out in TFA:
Palm Inc., which makes the popular Treo phones, puts directions deep within its Web site for what it calls a "zero out reset." It involves holding down three buttons simultaneously while pressing a fourth tiny button on the back of the phone.
But it's so awkward to d
Re: (Score:2)
> What are we now, chimps?
It's certainly not easy to do by yourself. You have to hold the stylus between your knees, balance the phone on top of the stylus by holding it at just the right angle with the fingers of your left hand. Then use your left thumb to push one button, your right index and ring to push to more, all while pushing down straight enough to activate the microswitch the stylus is sitting on.
Behooves (Score:2)
I would expect someone who uses 'behoove' so obliquely in conversation to be snappy enough to have already reached this conclusion.
Pointers? (Score:2)
And before you ask, YES, it's my phone.
(Nokia) IntelliSync Device Manager (Score:3, Informative)
The industry is already aware of the problem and has solved it.... the answer is:
Nokia/IntelliSync Device Manager OMA [nokiaforbusiness.com]
You buy a per device license and you can then use the licenses in any ratio between the Professional Edition (which specializes in PDA management) and the OMA edition which specializes in phones. With the OMA edition - for which I developed the training class - you can establish a secure trusted connection to the handset. A 4-digit hex fingerprint is required to avoid MITM. From that point on - any action can be carried out by the central adminstrator without further user intervention, including application installation, settings, inventory, and a complete device wipe. Available applications include Blackberry and 4-5 other email solutions, Norton AV, and Pointsec flash disk encryption.
The problem is not the technology the technology is HERE. The problems are:
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)