This post is also available in:
עברית (Hebrew)
Moving data from an old smartphone to a new one is supposed to be a simple process. Built-in migration tools can transfer photos, messages, applications and settings within minutes, often using a direct Wi-Fi connection between the two devices. However, that convenience can create a security risk when the transfer itself is not adequately protected.
Security researchers have uncovered critical vulnerabilities in Android data migration tools that could allow nearby attackers to intercept sensitive information or manipulate files being transferred between smartphones.
The vulnerabilities were discovered by researchers from Graz University of Technology and the Austrian cybersecurity organization A-SIT.
According to TechXplore, the investigation covered migration applications from seven major Android manufacturers: Google, Samsung, Vivo, Xiaomi, Oppo, Huawei and Honor.
These included widely used tools such as Samsung Smart Switch, Google Android Switch and Xiaomi Mi Mover.
The researchers found security weaknesses in every application examined, potentially allowing attackers to interfere with transfers without physically accessing either smartphone.
The attacks required only proximity to the devices’ Wi-Fi connection, with an effective indoor range of approximately 20–45 meters.
Using equipment costing less than €100, the researchers demonstrated that an attacker could intercept information exchanged during the migration process.
The exposed data could include text messages, contacts, photographs, call records, health information, saved Wi-Fi credentials and application passwords.
In some cases, the vulnerabilities also allowed malicious software to be introduced onto the receiving smartphone through manipulated application packages.
This makes the attack particularly concerning because migration tools transfer much of a user’s digital information in a single operation.
Locations such as electronics retailers and mobile phone stores, where numerous devices are configured and data transfers occur regularly, could present attractive opportunities for nearby attackers.
The findings also have implications for military and homeland-security personnel, whose smartphones may contain sensitive communications, contact information or credentials associated with operational networks. An intercepted transfer could potentially expose information beyond the personal data stored on the device.
The affected applications have accumulated more than 12 billion downloads collectively, highlighting the scale of their use, although this figure does not represent the number of unique affected users.
Following responsible disclosure by the researchers, all seven manufacturers released security updates addressing the reported vulnerabilities. Five of the resulting security alerts were classified as high severity.
The researchers recommend updating migration applications on both smartphones before transferring information. Some devices may also require a full operating-system update.
The research highlights a commonly overlooked cybersecurity risk: protecting data while it is stored on a smartphone is not enough if the process of moving that information to another device leaves it exposed.
The research was published here.
