Security Experts:

Connect with us

Hi, what are you looking for?


Mobile & Wireless

Android Backup Option Sends WiFi Passwords in Plaintext to Google

A staffer with the Elecontric Frontier Foundation is warning that Google Android’s “Back up my data” feature sends WiFi passwords and other private information out to Google in plaintext.

A staffer with the Elecontric Frontier Foundation is warning that Google Android’s “Back up my data” feature sends WiFi passwords and other private information out to Google in plaintext.

“Since backup and restore is such a useful feature, and since it’s turned on by default, it’s likely that the vast majority of Android users are syncing this data with their Google accounts,” Micah Lee, a staff technologist for the Electronic Frontier Foundation [EFF], explained in a feature request in Android’s bug tracker. “Because Android is so popular, it’s likely that Google has plaintext Wi-Fi passwords for the majority of password-protected wifi networks in the world.”

Lee suggested Google could address the issue by implementing this the same way Google Chrome’s sync feature is implemented – with options to either encrypt synced passwords with the user’s Google credentials or encrypt all synced data with the user’s own sync passphrase.

“The “Back up my data” option in Android is very convenient,” Lee wrote. “However it means sending a lot of private information, including passwords, in plaintext to Google. This information is vulnerable to government requests for data.”

This information could be vulnerable to government requests for data, he noted in a separate blog post, adding that Google is “part of NSA’s Prism program.” PRISM was exposed in the leaks of about NSA electronic surveillance programs by Edward Snowden, who is in currently in hiding and facing espionage charges in the United States.

“With your home wifi password, an attacker can sniff wifi traffic outside your house (without connecting to your network) and then decrypt it all, passively eavesdropping on your private network,” he blogged. “If the attacker wants to do more active attacks, they can connect to your wifi network and mount a man-in-the-middle attack to eavesdrop on and modify any unencrypted Internet traffic.”

“If you download a file, they can serve you a malicious version instead. An attacker can scan for computers, phones, and tablets that are connected to your network, scan for open ports, and exploit vulnerable services,” he added. “If you have a computer connected to your network that you haven’t done software updates on for a couple weeks, or that you’ve never configured a firewall on, or that you’ve installed random servers on and have never touched them since, there’s a good chance the attacker could take over those computers.”

Lee suggested users elect not to use the “Backup up my data” option.

Written By

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Mobile & Wireless

South Dakota Gov. Kristi Noem says her personal cell phone was hacked and linked it to the release of documents by the January 6...


A digital ad fraud scheme dubbed "VastFlux" spoofed over 1,700 apps and peaked at 12 billion ad requests per day before being shut down.

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Application Security

Software maker Adobe on Tuesday released security patches for 29 documented vulnerabilities across multiple enterprise-facing products and warned that hackers could exploit these bugs...