News, 02.12.2022, 02:30 AM
If you’ve ever been worried about your data stored on your computer or smartphone at the time you had to take the device in for repair, study of Canadian scientists has confirmed the justification of such fears because privacy violations occur in at least 50% of cases.
Researchers from the University of Guelph in Ontario, Canada, found logos on laptops that were sent for repair for the purposes of the study. The logs revealed that technicians from six services had accessed the personal data of users and that in two of those services the data was copied to the personal devices of the service providers.
It is interesting that something like this happens more often with devices belonging to women, and curious repairmen usually ask for data such as explicit but also other images, documents and financial information.
Hasan Khan, one of the researchers involved in the study, says they were surprised by the results because they thought the worst thing that would happen was that the service people looked at the data. However, as Khan said, the data copying that occurred during the repair of one male and one female user’s device is of particular concern.
Snooping on devices that shouldn’t be happening may be worse than noted in the study, which was conducted from October to December 2021.
The researchers took the laptops to 16 service centers. Two repairs were performed on site and in the presence of the user, so the technician did not have the opportunity to surreptitiously view their data on the device.
Researchers could not find logs on devices that were in the two services. In three cases, Windows Quick Access or Recently Accessed Files were deleted, and the researchers suspect that repairers tried to cover their tracks. After the repair at two services, the researchers could not access the logs, and the explanation they received from one of them was that the technicians installed antivirus software and performed a disk cleanup to “remove viruses from the device.” In the second case, there was no explanation.
In cases where it was noticed that user privacy was violated, it was about laptops with a freshly installed Windows 10 operating system. All were free of malware and other defects and in perfect condition with one exception: the audio driver was disabled. The researchers chose that problem because it required a simple intervention and did not require access to the user’s personal data.
Half of the laptops are configured to look like they belong to men and the other half to women. All the laptops had fictitious email and game accounts set up, and the browser on the devices had a browsing history built up over several weeks. The researchers added documents, both sexually explicit and other images, and a cryptocurrency wallet with credentials.
The researchers also configured the laptops to run a logging application that used the Windows Steps Recorder program in the background. In this way, they could record the screen at every mouse click and record everything that the user types on the keyboard. The researchers also enabled Windows Audit Policy to log access to all files on the device.
In addition to the above, the study revealed other problems. Most service providers required users to provide their password to log into the operating system even when it was not necessary for a repair.
These are the findings of a special part of the study, in which the researchers took the Asus UX330U laptop to 11 service centers for battery replacement. This repair does not require the technician to log into the computer, as removing the back of the device and accessing the device’s BIOS (to check battery status) is all that is required. Despite this, all but one service asked for device OS credentials.
When the user asked if a repair was possible without giving the password, three servicemen refused to take the device without the password, four agreed to take it, but warned that they would not be able to check the operation of the device or be responsible for it, one asked the user to remove the password and one said they would reset the device if necessary.
While the results of this study may come as a surprise to most people, they only confirm what many more experienced computer users already know: that their data is at risk or even copied when they hand over their device to an untrusted or unknown person, especially if that person has a password to apply.
Photo by Maria Buloczka from Pexels
