A staffer with the Elecontric Frontier Foundation is warning that Google Android’s “Back up my data” feature sends WiFi passwords and other private information out to Google in plaintext.
“Since backup and restore is such a useful feature, and since it’s turned on by default, it’s likely that the vast majority of Android users are syncing this data with their Google accounts,” Micah Lee, a staff technologist for the Electronic Frontier Foundation [EFF], explained in a feature request in Android’s bug tracker. “Because Android is so popular, it’s likely that Google has plaintext Wi-Fi passwords for the majority of password-protected wifi networks in the world.”
Lee suggested Google could address the issue by implementing this the same way Google Chrome’s sync feature is implemented – with options to either encrypt synced passwords with the user’s Google credentials or encrypt all synced data with the user’s own sync passphrase.
“The “Back up my data” option in Android is very convenient,” Lee wrote. “However it means sending a lot of private information, including passwords, in plaintext to Google. This information is vulnerable to government requests for data.”
This information could be vulnerable to government requests for data, he noted in a separate blog post, adding that Google is “part of NSA’s Prism program.” PRISM was exposed in the leaks of about NSA electronic surveillance programs by Edward Snowden, who is in currently in hiding and facing espionage charges in the United States.
“With your home wifi password, an attacker can sniff wifi traffic outside your house (without connecting to your network) and then decrypt it all, passively eavesdropping on your private network,” he blogged. “If the attacker wants to do more active attacks, they can connect to your wifi network and mount a man-in-the-middle attack to eavesdrop on and modify any unencrypted Internet traffic.”
“If you download a file, they can serve you a malicious version instead. An attacker can scan for computers, phones, and tablets that are connected to your network, scan for open ports, and exploit vulnerable services,” he added. “If you have a computer connected to your network that you haven’t done software updates on for a couple weeks, or that you’ve never configured a firewall on, or that you’ve installed random servers on and have never touched them since, there’s a good chance the attacker could take over those computers.”
Lee suggested users elect not to use the “Backup up my data” option.