Your private data on your Android phone is up for grabs

What if I didn't root my phone or tablet and I've set a pattern lock, PIN, or password. My data is safe, right?

Nope.

USB debugging breaks your lockscreen

USB debugging lets your computer manage things on your Android phone or tablet. That can be very useful, but it can be very dangerous too.

Have a pattern lock? Good for you. Even the FBI can't crack it. Unless you leave USB debugging switched on, because then even the spotty teenager next door can throw some adb at your phone and pwn it without limits. Having a rooted phone helps the burglars, but root is not required to crack your pattern lock. To make things worse, a similar procedure kills your PIN or password lock as well. Take home message: if you leave USB debugging on your lockscreen is wide open.

And as if that's not bad enough, keeping USB debugging active lets any toddler flash your phone. A new system partition together with your old data partition that holds your address book, messages, etcetera... ouch!

A custom recovery recovers too much

USB debugging switched off, now my data is safe, right?

Nope, it isn't.

If the bad guy can reboot into recovery he's in. No USB debugging needed. And if you have a custom recovery installed (and if you read this blog you probably have) your data is up for grabs too. Any thief can boot into your recovery menu and mount the data partition. Or make a Nandroid backup of your entire phone and extract your data from the backup. Apps like Titanium can restore some very private data from Nandroid backups, even if the Nandroid was made on another phone. To close this security hole, future versions of ClockWorkMod recovery and the likes should let you set a PIN or password so you can keep the unwanted out of your recovery.

Open bootloader is open phone

And even password-protected recoveries are not enough. If your bootloader can be unlocked, a thief could unlock it, flash a custom recovery, and he's in.

The only phone that appears safe is a phone with a locked bootloader, no custom recovery installed, and USB debugging switched off. Wouldn't it be time for Android to encrypt its data partition?

Wipe!

If your phone gets lost or stolen and your private data should stay private, Don't assume the locks on your phone will hold. Try to do a remote wipe as soon as possible. Apps like avast can help you erase your tracks before they fall into the wrong hands. Even if your remote wipe succeeds, the thief may already have made a backup to pry open at his leisure. So if your phone goes missing, don't forget to change the passwords for all your accounts everywhere, starting with your email.