Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

Android Backup Option Sends WiFi Passwords in Plaintext to Google

A staffer with the Elecontric Frontier Foundation is warning that Google Android’s “Back up my data” feature sends WiFi passwords and other private information out to Google in plaintext.

A staffer with the Elecontric Frontier Foundation is warning that Google Android’s “Back up my data” feature sends WiFi passwords and other private information out to Google in plaintext.

“Since backup and restore is such a useful feature, and since it’s turned on by default, it’s likely that the vast majority of Android users are syncing this data with their Google accounts,” Micah Lee, a staff technologist for the Electronic Frontier Foundation [EFF], explained in a feature request in Android’s bug tracker. “Because Android is so popular, it’s likely that Google has plaintext Wi-Fi passwords for the majority of password-protected wifi networks in the world.”

Lee suggested Google could address the issue by implementing this the same way Google Chrome’s sync feature is implemented – with options to either encrypt synced passwords with the user’s Google credentials or encrypt all synced data with the user’s own sync passphrase.

“The “Back up my data” option in Android is very convenient,” Lee wrote. “However it means sending a lot of private information, including passwords, in plaintext to Google. This information is vulnerable to government requests for data.”

This information could be vulnerable to government requests for data, he noted in a separate blog post, adding that Google is “part of NSA’s Prism program.” PRISM was exposed in the leaks of about NSA electronic surveillance programs by Edward Snowden, who is in currently in hiding and facing espionage charges in the United States.

“With your home wifi password, an attacker can sniff wifi traffic outside your house (without connecting to your network) and then decrypt it all, passively eavesdropping on your private network,” he blogged. “If the attacker wants to do more active attacks, they can connect to your wifi network and mount a man-in-the-middle attack to eavesdrop on and modify any unencrypted Internet traffic.”

“If you download a file, they can serve you a malicious version instead. An attacker can scan for computers, phones, and tablets that are connected to your network, scan for open ports, and exploit vulnerable services,” he added. “If you have a computer connected to your network that you haven’t done software updates on for a couple weeks, or that you’ve never configured a firewall on, or that you’ve installed random servers on and have never touched them since, there’s a good chance the attacker could take over those computers.”

Lee suggested users elect not to use the “Backup up my data” option.

Advertisement. Scroll to continue reading.
Written By

Marketing professional with a background in journalism and a focus on IT security.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Mobile & Wireless

Samsung smartphone users warned about CVE-2023-21492, an ASLR bypass vulnerability exploited in the wild, likely by a spyware vendor.

Malware & Threats

Apple’s cat-and-mouse struggles with zero-day exploits on its flagship iOS platform is showing no signs of slowing down.

Fraud & Identity Theft

A team of researchers has demonstrated a new attack method that affects iPhone owners who use Apple Pay and Visa payment cards. The vulnerabilities...

Mobile & Wireless

Critical security flaws expose Samsung’s Exynos modems to “Internet-to-baseband remote code execution” attacks with no user interaction. Project Zero says an attacker only needs...

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Mobile & Wireless

Asus patched nine WiFi router security defects, including a highly critical 2018 vulnerability that exposes users to code execution attacks.