To sell, or not to sell: social media data-breach in second-hand Android devices

Abstract

Purpose The purpose of this paper is to investigate the private-data pertaining to the interaction of users with social media applications that can be recovered from second-hand Android devices. Design/methodology/approach This study uses a black-box testing-principles based methodology to develop use-cases that simulate real-world case-scenarios of the activities performed by the users on the social media application. The authors executed these use-cases in a controlled experiment and examined the Android smartphone to recover the private-data pertaining to these use-cases. Findings The results suggest that the social media data recovered from Android devices can reveal a complete timeline of activities performed by the user, identify all the videos watched, uploaded, shared and deleted by the user, disclose the username and user-id of the user, unveil the email addresses used by the user to download the application and share the videos with other users and expose the social network of the user on the platform. Forensic investigators may find this data helpful in investigating crimes such as cyber bullying, racism, blasphemy, vehicle thefts, road accidents and so on. However, this data-breach in Android devices is a threat to user's privacy, identity and profiling in second-hand market. Practical implications Perceived notion of data sanitisation as a result of application removal and factory-reset can have serious implications. Though being helpful to forensic investigators, it leaves the user vulnerable to privacy breach, identity theft, profiling and social network revealing in second-hand market. At the same time, users' sensitivity towards data-breach might compel users to refrain from selling their Android devices in second-hand market and hamper device recycling. Originality/value This study attempts to bridge the literature gap in social media data-breach in second-hand Android devices by experimentally determining the extent of the breach. The findings of this study can help digital forensic investigators in solving crimes such as vehicle theft, road accidents, cybercrimes and so on. It can assist smartphone users to decide whether to sell their smartphones in a second-hand market, and at the same time encourage developers and researchers to design methods of social media data sanitisation.

Security and Privacy with Second-Hand Storage Devices: A User-Centric Perspective from Switzerland

“…Despite substantial literature on potential risks (e.g., [27]), we are the first to look at whether the risks materialize in practice. Our results seem to indicate (in our, relatively small, dataset at least) that the risks rarely materialize (e.g., because buyers format devices immediately) 4 , at least with buyers that are not ill-intentioned. Despite these findings, even incidents for a small number of users can cause severe consequences.…”

“…Other researchers studied the effectiveness of deletion methods on storage devices. BenRhouma et al [4] analyze the data left on Android smartphones, after removing applications or doing a factory reset, and show that these operations did not effectively delete user data. Schneider et al [46] find that remnant data could be recovered from 'new' USB sticks due to memory-chip recycling.…”

إدارة انهيار السياق وعلاقته بالهوية المهنية لدى أعضاء هيئة التدريس بالجامعات فى ضوء نظرية إدارة خصوصية الاتصالات(CPM) theory

“…The exchange of second-hand devices can also lead to data leaks [16]. Some participants like P6 worried about unwiped data: "When you get second-hand phones, they're contaminated .…”