Risk when switching phones: TU Graz finds flaws in migration apps from seven makers
According to TU Graz, apps that move data to a new Android phone could be eavesdropped on and manipulated from up to 45 metres away. The manufacturers have released updates.
Graphic: TERRA WORLD NEWS (own graphic based on the sources listed)
Anyone switching to a new smartphone usually relies on an app that transfers photos, contacts and messages. Researchers at Graz University of Technology (TU Graz) and the Center for Secure Information Technology A-SIT examined seven such tools from Android manufacturers: Switch (Google), Smart Switch (Samsung), EasyShare (Vivo), Mi Mover (Xiaomi), Clone Phone (Oppo), Phone Clone (Huawei) and Device Clone (Honor). According to the researchers, the mostly preinstalled apps have more than 12 billion downloads combined. The "Clone2Pwn" study by the team around Florian Draschbacher and Stefan Mangard was presented in September at the ESORICS 2026 security conference in Rome; TU Graz made the results public on 15 October.
Most of the tools set up a direct Wi-Fi connection between the devices. With equipment costing under 100 euros, attackers indoors could read the data stream and manipulate the transfer from roughly 20 to 45 metres away. Exposed data included text messages, contacts, photos, call logs, health data and stored Wi-Fi and app passwords. With five of the tools, malware could also be slipped onto the new device. The researchers single out electronics stores and phone shops, where many devices are set up every day, as particularly risky.
The vulnerabilities were reported to the manufacturers in advance and resulted in eight CVE entries, five of them rated high. All seven manufacturers confirmed the issues and released security updates. Before switching phones, users should install the current version of the migration app on both devices and apply all updates – on some devices this requires an operating system update.