Tuesday, September 18, 2012

How I got his social, license, and credit card via Android

Android.

A few weeks ago, I purchased a Samsung Galaxy S2 to test my app. I'm mostly an iOS guy, so I wasn't prepared for what I would find on the new phone.

I buy and sell on craigslist quite a bit, and looking now, there are plenty of phones up for sale.


So I bought an S2. When I met the seller, he clearly showed me that the phone booted had been wiped. Or so we thought.

The thing is, when you wipe an iOS device, you wipe the device. All data is gone, and you get to start over. Resetting an Android phone, however, is only step one.

Some time into development, I realized that the Gallery app (right next to the undeletable "Let's Golf 2 HD") had images in it. Curious, I scrolled through the gallery to find photos that were not my own.

And what did I find?

First, I found a picture of the social security card of the seller. Woah! I was astounded. How did this happen? Wondering what else I would find, I kept scrolling.

And then I found his license.
And then I found his credit card, front and back.

Turns out, if you want to wipe an Android phone, you need to go through an elaborate process to clear the SD card.

This is godawful design. I don't blame the seller for not "Formatting the SD card"; he probably doesn't even know what an SD card is. How many android users do? I doubt many. Seller guy went through the reset device prompts, and that should have been all that was necessary.

I've since deleted the images, but not everyone would have been so kind. This is a critical design flaw in Android, and I wonder how profitable it would be to just collect every value priced Android feature phone with a camera on craigslist.

The worst part about all this is that the seller was getting cash to buy an S3, and I bet this will happen again.