Frozen Android is defenseless

[Somelike]

ExtremeTech.com has a sobering article about Android encryption and security that I think you may want to know about.

How to bypass an Android smartphone's encryption and security: Put it in the freezer

A few people - those who locked themselves out of their own device - may welcome this news, though.
For the rest of us it is a nightmare.

 

[gtbarry]

Not a huge concern to me:

"they can extract photos, surfing history, and contact lists"
- could be a lot worse

"when power is cut, it actually takes a few seconds or minutes for the data to be lost. If you have some way of reading the RAM, you can extract all sorts of sensitive information"
- So a stranger/thief would have to be able to have access to my phone and the ability to place in a freezer within minutes. And probably a colder than normal freezer to have a better chance at success.

Also, nice of them to highlight Android in this. When if you read about the process involved, it is any RAM for any computer/mobile device and not Android specific.

 

[Somelike]

- So a stranger/thief would have to be able to have access to my phone and the ability to place in a freezer within minutes.

No, he can wait 2 days or 2 weeks before he puts it in the freezer. But when he takes it out of the freezer he needs to be fast before the RAM heats up again.

Solution: don't take it out of the freezer... duh!

 

[gtbarry]

No, he can wait 2 days or 2 weeks before he puts it in the freezer.

Not true in the slightest. In the article it clearly states:
"RAM is volatile, and it does require regular spikes of power to retain its data

 

[Somelike]

if you didn't freeze it within a few minutes the RAM will be emptied BEFORE you freeze it.

"If you didn't freeze it within a few minutes" of switching off the entire phone "the RAM will be emptied BEFORE you freeze".
As long as the phone is switched on the RAM ain't going nowhere.

 

[pastafarian]

Note to self, stop storing phone in deep freeze!


As mentioned, not Android specific beyond the use of Android based tools in this case. Unless you're storing highly sensitive and/or valuable data for a nation or corporation, I don't think you have to fear this exploit.