Phone Switch: All Seven Android Transfer Apps Had Security Vulnerabilities

TVS News AI, editorially supervised, presents Phone Switch: All Seven Android Transfer Apps Had Security Vulnerabilities.

Picture this: you're standing in an electronics store, a new contract freshly signed, the brand-new Android device in your hand – and photos, chat histories and saved Wi-Fi keys are already migrating to its display via the manufacturer's app. What feels routine was, for months, an open gateway. Security researchers at TU Graz, in cooperation with the Center for Secure Information Technology A-SIT, took apart seven widely used Android data migration apps under real-world conditions. Their verdict is unambiguous: not a single one of the tested applications withstood the scrutiny.

The Study at a Glance

Under the title "Clone2Pwn: A Systematic Security Analysis of Data Migration Tools in the Android Ecosystem," the team around Florian Draschbacher (alongside Lukas Maar, Lorenz Schumm, Rene Denifl, Lukas Treffner, and Stefan Mangard) presented their results in October 2026 at the European Symposium on Research in Computer Security (ESORICS) in Rome. They examined the phone-transfer tools from seven manufacturers – namely Switch from Google, Smart Switch from Samsung, EasyShare from Vivo, Mi Mover from Xiaomi, Clone Phone from Oppo, Phone Clone from Huawei, and Device Clone from Honor. The bottom line: in every one of these apps the researchers found vulnerabilities that could be exploited in different attack scenarios.

How the Test Worked

Migration tools typically establish a direct Wi-Fi connection between the two smartphones for the device handover, with no detour through a cloud server. But that procedure alone offers no protection, the researchers stress. They formulated six separate attack scenarios and translated these into 15 concrete security requirements. Each app was measured against this benchmark.

What Could Happen in a Real Attack

The reach of such attacks is startlingly close to everyday life: indoors, 20 to 45 meters of distance were enough to intercept the data stream. Standard hardware costing under 100 euros was sufficient. If the attack succeeded, SMS, contact lists, photo galleries, call logs and in some cases medical information opened up – including Wi-Fi passwords and credentials for other apps. In five of the seven tools it was also possible to smuggle manipulated installation packages onto the target device, paving the way for malware. Three apps were additionally vulnerable via malware already installed on the source phone.

The Scale Makes the Problem Big

What makes matters worse: these apps come pre-installed on almost every Android smartphone and are routinely used when switching devices. In total, the affected applications together log more than twelve billion downloads – though that figure counts installations, not necessarily unique users. The study names electronics stores and mobile-phone outlets as particularly sensitive locations, where numerous devices are freshly set up every day.

Varying Severity

How vulnerable an app was varied from manufacturer to manufacturer. Samsung Smart Switch and Vivo EasyShare each showed flaws in three of the six scenarios. Google Android Switch fared best with just one proven scenario, although here the weakly secured Wi-Fi connection could be decrypted and read along. Six of the seven applications suffered from weak Wi-Fi passwords or other wireless vulnerabilities. In Google's case, the data leak also involved health data – among them information about sexual activity and reproductive health, which moreover could not be selectively excluded from the transfer. Data manipulation during transfer could not, however, be proven for Google.

How Samsung Came Under the Microscope

With Smart Switch, the researchers exploited a vulnerability already during connection setup. They positioned themselves between the devices and watched messages, photos, contacts and stored Wi-Fi credentials in plaintext. In addition, they managed to replace an in-progress app installation with a prepared package – and thus plant malware on the new phone. Notably, Samsung did include stronger Wi-Fi encryption in its tool than several competitors, but the gap-ridden connection setup cancelled out that advantage.

Responsible Disclosure and Response

Before the paper went public, the researchers informed all affected corporations as part of a responsible disclosure process. The result: eight officially registered vulnerabilities, five of them rated high. All seven manufacturers confirmed the findings and subsequently released security updates. Protection, however, exists only where the patches have actually been installed. Since the recorded attacks target specific software versions, some of which are now outdated, the personal risk depends on the software version in use.

Because these apps come pre-installed and are very convenient for moving data to a new phone, these security vulnerabilities have enormous impact.

Concrete Tips Before Your Next Phone Switch

If you're about to set up a new Android phone, you should work through the following points before data starts moving: install the latest operating system and security updates on both the old and new device. Make sure the transfer app you're using is in the latest version – in some cases a full OS update is required to get it. Carry out the migration at home if possible, not in a busy store. When setting up, only confirm the connection to your own new device. Once complete, check that all data has arrived in full and that no unfamiliar apps have appeared. An alternative for Samsung users: Smart Switch supports the transfer via USB cable between Android devices – that rules out wireless attacks. However, malware already present on the source device remains a risk even with a cable, so the old device's software should be kept up to date as well.