The secondhand mobile device market is huge. According to Deloitte, used smartphones bring in more than $17 billion per year as they’re sold, traded and repurposed by new users.

But there’s a mobile device security problem flying under the radar: CSO Online said more than 40 percent of resold devices still contained the personally identifiable information (PII) of their previous owners, despite being wiped by for-hire data deletion companies. How do users ensure data actually disappears before they cash in on the secondhand market?

Creating a Disappearing Act

Growth of the secondhand market makes sense given the steep price of new smartphones and tablets. Rather than simply recycling their devices, consumers prefer to upcycle technology and recoup some of the cost in the process. But commercial erasure offerings aren’t up to snuff: A recent study by the National Association for Information Destruction (NAID) found that no specialized tools or software were used to delete the data from any of the 250 devices analyzed.

John Benkert, CEO of CPR Tools, which provides data recovery solutions, put it simply to CSO Online: “A 5-year-old with some free software off the web could have done it.”

With this in mind, it’s no surprise that 13 percent of smartphones, 44 percent of hard drives and 50 percent of tablets all contained recoverable PII, according to the NAID study. This information ran the gamut, from credit card data to names, addresses, emails, usernames, passwords and social media credentials.

And this is just the tip of the iceberg. The NAID researchers used very basic methods to grab a host of data. If interested parties choose to dig deeper, the resulting mobile device security impacts are staggering — users could find their entire lives compromised after a seemingly straightforward mobile device sale.

Potential Future Failures?

The availability of PII on secondhand mobile devices is worrisome, but it’s only the beginning. What happens when always-connected IoT devices enter the mix?

As noted by Charles Henderson of IBM’s X-Force, there’s real risk here. After selling a connected car and purchasing another model from the same manufacturer, Henderson discovered that he could still access the original vehicle’s digital information and even exert ownership control.

Now extend this to smart home devices — everything from thermostats and alarm panels to wireless fridges and dishwashers — and new avenue for compromise appears: If malicious actors get their hands on secondhand devices, former owners could be in significant jeopardy.

Increasing Mobile Device Security

So how do users ensure their mobile device data is actually gone before putting their smartphone or tablet up for sale? Start by reading the fine print from any commercial deletion service, since many opt out of any legal responsibility and instead put the onus on users.

It’s also worth asking about exactly how data will be deleted. Why? Because simply deleting data isn’t a viable form of mobile device security, since the information is hidden from view but it’s not really gone. The better alternative is overwriting data with something else to effectively prevent reconstitution.

Encryption is also critical. While factory resets can help reduce the chance of data recovery, encryption offers a better way to protect against accidental oversights and frustrate second-rate, secondhand cybercriminals.

The bottom line? Secondhand mobile devices often contain large amounts of first-party data. Deletion alone isn’t enough to fully wipe smartphones and tablets; instead, opt for a combination of encrypted and overwritten information to limit total risk.

More from

BlackCat (ALPHV) Ransomware Levels Up for Stealth, Speed and Exfiltration

9 min read - This blog was made possible through contributions from Kat Metrick, Kevin Henson, Agnes Ramos-Beauchamp, Thanassis Diogos, Diego Matos Martins and Joseph Spero. BlackCat ransomware, which was among the top ransomware families observed by IBM Security X-Force in 2022, according to the 2023 X-Force Threat Intelligence Index, continues to wreak havoc across organizations globally this year. BlackCat (a.k.a. ALPHV) ransomware affiliates' more recent attacks include targeting organizations in the healthcare, government, education, manufacturing and hospitality sectors. Reportedly, several of these incidents resulted…

9 min read

Now Social Engineering Attackers Have AI. Do You? 

4 min read - Everybody in tech is talking about ChatGPT, the AI-based chatbot from Open AI that writes convincing prose and usable code. The trouble is malicious cyber attackers can use generative AI tools like ChatGPT to craft convincing prose and usable code just like everybody else. How does this powerful new category of tools affect the ability of criminals to launch cyberattacks, including social engineering attacks? When Every Social Engineering Attack Uses Perfect English ChatGPT is a public tool based on a…

4 min read

Despite Tech Layoffs, Cybersecurity Positions are Hiring

4 min read - It’s easy to read today’s headlines and think that now isn’t the best time to look for a job in the tech industry. However, that’s not necessarily true. When you read deeper into the stories and numbers, cybersecurity positions are still very much in demand. Cybersecurity professionals are landing jobs every day, and IT professionals from other roles may be able to transfer their skills into cybersecurity relatively easily. As cybersecurity continues to remain a top business priority, organizations will…

4 min read

How I Got Started: White Hat Hacker

3 min read - White hat hackers serve as a crucial line of cyber defense, working to identify and mitigate potential threats before malicious actors can exploit them. These ethical hackers harness their skills to assess the security of networks and systems, ultimately helping organizations bolster their digital defenses. But what drives someone to pursue a career as a white hat hacker, and how do you get started in leveraging so-called “evil” skills for the greater good?? In this exclusive Q&A, we spoke with…

3 min read