Symantec: 96% lost smartphones accessed by finders

While only half of stolen or lost smartphones will likely be returned to their owners, the mostly private data on a whopping 96 percent are likely to have been accessed by their finders.

 

This was one of the key findings of computer security vendor Symantec's "Smartphone Honey Stick Project," an experiment on what happens to stolen or lost smartphones.

 

"Only half of the people who found one of the phones made any attempt to return it. Maybe you think that having a 50/50 chance of getting a phone back is a glass half-full situation. Sorry, but I have to drain your glass: Even the people who attempted to return the phones made attempts to view the data on them. In fact, 96 percent of our lost smartphones were accessed by their finders," Symantec's Kevin Haley said in a blog post.

 

He said the finders of the lost devices attempt to access more than the identity of the found phone's owner. Citing the study, he said:

 

 

"It's just as bad for consumers. Not only does our research show that your private pictures, social media accounts, and email are going to be accessed if your phone is lost and found, nearly half of the finders tried to access the owner's bank account!" he added.

 

He said the study showed people are "naturally curious and when temptation is put in front of them they tend to bite the apple (some take many bites)."

 

"The lesson to take away here is that we have to protect our mobile devices. The good news is that it is really not that hard to do," he said.

 

Haley noted smartphones today have become integrated into people's lives, carrying even more valuables than a wallet does.

 

Among the "valuables" smartphones are likely to store are contact information of friends, and even the ability to carry out financial transactions.

 

"Nearly all have the capability to run apps that can access our bank accounts," he said.

 

Intentionally lost devices

 

With the help of Scott Wright of Security Perspectives Inc., Symantec intentionally lost 50 smartphones with simulated corporate and personal data on them - along with the capability to remotely monitor what happened to them once they were found.

 

The 50 smartphones were dropped in five different cities: New York City; Washington D.C.; Los Angeles; San Francisco; and Ottawa, Canada.

 

Smartphones in the experiment were left in high traffic public places such as elevators, malls, food courts, and public transit stops.

 

Protection

 

Haley said two things would have protected all of the data, personal and business, on these phones: password protection and remote data wiping.

 

"Just giving the phone password-based security would have prevented the casual finder from trolling through the data. The second thing is to have the ability to remotely wipe the data off the phones once it had been lost. In this way, even if the phone fell into the hands of a determined thief, there would be no data for them to find," he said.

 

Also, he said it is a good idea to have software on the phone to help locate it if lost as well.

 

Recommendations

 

For corporate devices, Symantec recommended the following steps to ensure that sensitive business information remains protected:

 

 

On the other hand, consumers are advised to take the following steps to ensure mobile devices and the personal information on the devices remains protected:

 

— TJD, GMA News