Samsung adds 'repair mode' that hides data on Galaxy smartphones in South Korea
- Reference: 1659329954
- News link: https://www.theregister.co.uk/2022/08/01/samsung_galaxy_smartphone_repair_mode/
- Source link:
When activated, [1]repair mode prevents a range of behaviors – from casual snooping to outright lifting of personal data – by blocking access to photos, messages, and account information.
The mode provides technicians with the access they require to make a fix, including the apps a user employs. But repairers won't see user data in apps, so content like photos, texts and emails remains secure.
[2]
When users enable repair mode their device reboots. To exit, the user reboots again after logging in their normal way and turning the setting off.
[3]
[4]
Samsung said it is rolling out repair mode via software update, initially on the Galaxy S21 series within South Korea, with more models, and perhaps locations, getting the functionality over time.
[5]How ICE became a $2.8b domestic surveillance agency
[6]Indian government starts work on right to repair rules
[7]Samsung boss likely to be pardoned for bribery
[8]FTC suddenly gets very stern about not-really-anonymized anonymized data
Samsung has not explained how the feature works. Android devices already offer the chance to establish accounts for different users, so perhaps Samsung has created a role for repair technicians and made that easier to access.
Most repair technicians won't want to view or steal a customer's personal data – but it does happen.
Apple was [9]forced to pay millions last year after two iPhone repair contractors allegedly stole and posted a woman's nudes to the internet. That fiasco was in no way an isolated incident. In 2019 a Genius Bar employee [10]allegedly texted himself explicit images taken from an iPhone he repaired and was subsequently fired.
[11]
One internet user even [12]claimed a repair technician used his phone to leave himself a positive review for repair services.
Repair mode could also come in handy in situations such as domestic abuse or personal protests against [13]overzealous immigration agents .
And while it's not yet a feature on most laptops, its surely one Hunter Biden would have appreciated before dropping off his laptops for repairs. The contents of his hard drives – and the veracity of reports about their retrieval – are quite the political football. ®
Get our [14]Tech Resources
[1] https://news.samsung.com/kr/%ec%82%bc%ec%84%b1-%ea%b0%a4%eb%9f%ad%ec%8b%9c%ed%8f%b0%ec%97%90-%ec%88%98%eb%a6%ac-%eb%aa%a8%eb%93%9c-%ec%b6%94%ea%b0%80-%ea%b0%9c%ec%9d%b8%ec%a0%95%eb%b3%b4-%ec%9c%a0%ec%b6%9c-%ec%9b%90
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YuekW4Ty7asVCWkYmJ6gLgAAAFE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YuekW4Ty7asVCWkYmJ6gLgAAAFE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YuekW4Ty7asVCWkYmJ6gLgAAAFE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2022/05/14/ice_28bn_domestic_surveillance/
[6] https://www.theregister.com/2022/07/18/india_right_to_repair_framework/
[7] https://www.theregister.com/2022/07/28/samsung_boss_likely_to_be/
[8] https://www.theregister.com/2022/07/12/ftc_anonymized_data/
[9] https://www.theregister.com/2021/06/07/apple_college_student_photo_leak/
[10] https://www.washingtonpost.com/technology/2019/11/12/an-apple-store-employee-helped-customerby-texting-himself-private-photo-her-phone/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YuekW4Ty7asVCWkYmJ6gLgAAAFE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.quora.com/My-phone-repair-guy-fixed-my-phone-charger-but-asked-for-my-password-altered-my-phone-settings-greatly-and-left-himself-a-positive-review-on-his-business-using-my-phone-Is-this-normal
[13] https://www.nbcnews.com/news/us-news/what-if-u-s-border-agents-ask-your-cellphone-n742511
[14] https://whitepapers.theregister.com/
How do you turn it off again?
"To exit, the user reboots again after logging in their normal way and turning the setting off"
So how does this provide security? I've never taken a phone in for repair but I would assume you disable login or give the tech a temporary pin.
Am I wrong? What keeps the tech from just turning the setting off?
Re: How do you turn it off again?
It sounds like you might need more credentials to turn it off than you do to open the device. Perhaps the pin unlocks the device, but the user has to enter their account password to disable the feature. I wouldn't expect this to withstand an attack by someone with exploits, but hopefully it's at least a step above what we have now.
Re: How do you turn it off again?
"Perfection is the enemy of the good."
Will this prevent state-sponsored attackers stealing your data? Nope.
Will help prevent idle browsing of your holiday photos by repair techs? Yes.
Re: How do you turn it off again?
It’s a valet key for devices. Technicians will have their own login.
It's a good idea in theory, but I feel it may be of limited use in practice, certainly for the large number of devices that are completely non-functional at the point where they are brought to me (doesn't switch on, screen is smashed, charging port is knackered and they've waited until the battery is totally flat to do anything about it etc)
If the customer can't get into the phone, they can't leave it in repair mode, so after repairing it, I'm generally still not going to be able to test that it's fully functional until the customer unlocks it, or trusts me with the unlock code.
What we need is a technician's testing mode that does not require getting past the user's security settings to enable it. Something that can be accessed through the recovery menu, that allows us to fully test the functionality of the device without accessing or overwriting the user's data, and without potentially giving a route to turning a stolen phone into a sellable one. Perhaps a mode that only functions when USB tethered to a technician's computer? Or engineer's firmware that can be flashed to RAM without overwriting the ROM?
Of course, if they just designed the things so users were able to create an encrypted back up of a broken device via USB, without needing a functional screen to do it, this would be far less of a problem to start with.
Surely this is better handled with encryption
User's data is encrypted with a personal key that is obtained from
Device goes in for repair, which invalidates and clears the cache of keys.
Device is repaired and fully operational.
User's data is optionally restored from latest encrypted backup (still inaccessible on the device).
Device is returned to user.
User authenticates, and personal key is restored from
Obviously I've left some of the clever bits in the "
Or they could just make them more repairable then I don't have to hand it over to anyone.