“Frost” Attack Unlocks Android Phones' Data By Chilling Their Memory In A Freezer
A wrapped-up Samsung Galaxy Nexus in a freezer, as a researcher measures its temperature. — If you lose possession of an Android phone, your PIN or pattern unlock might not be enough to protect the sensitive data stored on it.
Context & Ripple Effects
Android entered 2013 with substantial distribution: Canalys estimated it powered a third of mobile phones shipped in Q4 2012, while related coverage described its strength in European and non-U.S. smartphone markets. That scale makes a physical-access weakness more consequential than a flaw confined to one handset.
The demonstrated method changes the meaning of a lost phone: a screen PIN or pattern is not necessarily the final barrier to data when an attacker can take possession of the device.
First-order effects
- Android phone owners who lose physical control of a handset face exposure of data protected only by the lock screen; the Samsung Galaxy Nexus serves as the demonstrated example.
- Android and handset makers must treat data protection after device seizure as a separate security requirement from ordinary screen unlocking.
Second-order effects
- Enterprise buyers and security-conscious consumers have reason to scrutinize whether Android handsets protect stored data independently of the PIN or pattern interface.
- Android vendors competing on device security face pressure to make physical-access resistance, rather than lock-screen convenience alone, part of their product differentiation.
Third-order effects
- As Android's installed base expands, mobile security shifts from preventing casual access to protecting data against attackers with the handset in hand.
- The episode points toward a security model in which credentials, stored-data protection, and hardware behavior must be evaluated together rather than as separate features.
The trend: Mobile-device security is moving beyond the lock screen toward defenses designed for adversaries who obtain physical possession of the phone.