Cybersecurity expert Robert Siciliano bought 30 used phones from eBay and Craigslist and found half still contained passwords, banking info, and photos after factory resets. Android devices were especially vulnerable. He recommends multiple resets or destroying the phone instead of selling it, since 10 million people fall victim to identity theft annually.
Chapters
Phone numbers, passwords, bank account info— you know how to put all that stuff into your smartphone, but do you know how to get your personal info off of it? Even if you think that you've wiped your smartphone clean before you get rid of it, it's probably not enough.
So what can you do? John Shenweis here now with more on how to protect yourself. John?
Yeah, we are talking about basic identity theft here, and when we're talking about smartphones, whether it's the BlackBerry, the iPhone, or the Droid, they are not created equal.
For many, they have become as much a part of our lives as the food we eat.
It's like an appendage.
A critical necessity we use to keep our lives organized.
It's my best friend.
And what we need to know close at hand.
It's pretty critical. I mean, uh, basically my whole life is on this phone.
Life's critical details.
Probably my checking account.
It provides me with a connection to everything that I need.
In fact, with memory sizes growing, smartphones today can carry almost as much personal information as we used to store on our laptop or our home computer.
All the contacts, all my phone numbers, um, my Facebook, so that kind of personal information too.
There's a lot of passwords to my internet, um, like my bank account, like my Facebook is all on there.
Just some of the personal kind of data that McAfee cybersecurity expert Robert Siciliano was looking into when he went online, scrolled through the vast smartphone offerings on eBay and Craigslist, and bought 30 used devices.
I bought Androids, iPhones, and BlackBerrys, and I did this with McAfee— McAfee Antivirus—
and we found, uh, people's entire digital lives on half of the devices that he bought. Now, before Robert Siciliano tells you what he found, you should understand that his cyber technician was not using some CMU or CIA-specialized scanning software.
He just used regular tools that were available off the internet to look for this data, you know, on these devices. And he found everything.
Everything, as in—
People left all their information there. PDFs, Word documents, text files, Excel files, home videos, photos, and a lot of pornography, actually. Uh, we found their entire digital lives, enough information to either steal their identities or take over existing identities.
That, despite the best efforts of those selling the phones to wipe them clean.
Well, I delete the cache. You have to delete the cache. Make sure I take the SIM card out.
Removing the SIM card and the SD card from the phone is vital. Both are critical storage areas, but they aren't the only virtual file drawers in your smartphone.
The devices themselves generally have their own storage.
The cell phone manufacturers will tell you to go to your settings menu in your phone and restore the factory factory settings in order to clear out your personal information, which Siciliano says works pretty well in the BlackBerry and in iPhones.
But with the Android phones, the Motorola Droid specifically, even when a factory reset was done, we still found data.
Enough data to easily pull off identity theft.
10 million people every single year have their identity stolen. And Siciliano points out, if you're selling that device for like $50, Is it potentially worth $50 to sell your identity? I don't know.
Siciliano says while you might be okay cashing in on your BlackBerry or your iPhone, based on what his investigation found, he is not going to be your competition.
I will never ever sell or let go any secondhand device, uh, on eBay or Craigslist. I won't donate it.
I'll take that mobile phone, I'll destroy it, I probably wouldn't get rid of the phone. I'd probably keep it.
And that is probably the best idea. Just keep the doggone thing. But if you insist on selling your old phones, BlackBerrys and iPhones, Siciliano says do the factory reset on them 2, maybe 3 times, maybe even 4 times. And he adamantly advises against selling an old Droid. But again, if you insist, reset that factory reset 10, 12 times. And then you're just hoping for the best.
And then maybe do it another time.
And maybe just a 13th time for good luck.
What do I—
you know, it hasn't occurred to me that to buy a used cell phone— you know, they give you such great deals, you know, a lot of them you can get for free. Is it a good idea to look for used cell phones?
Again, in what they've discovered when they bought these phones, they found some spyware on the phones that was actually put there, designed so that when you buy it, you start putting in your personal information, it steals the information and sends it to to the person who put the spyware on there.
Wow.
He's abiding against it.
Never would have thought of that. John, thank you.
