The standard data migration tools offered by major Android manufacturers such as Samsung, Google and Xiaomi pose significant security risks, as researchers from the Institute of Information Security at Graz University of Technology (TU Graz) and Zentrum für sichere Informationstechnologie (A-SIT) have revealed in a recent study. Their research revealed that critical vulnerabilities in all the tools examined allowed attackers within Wi-Fi range to spy on private user data such as call logs, photos and login details.
Security risk associated with phone cloning
So-called phone clone tools or data migration tools are designed to make it easier to switch from an old smartphone to a new device. The aim is to transfer all data, settings and apps seamlessly from the old device to the new one. These tools usually establish a direct Wi-Fi (WLAN) connection between two smartphones without the need for an external server. However, research carried out by the Graz-based IT security researchers Florian Draschbacher, Lukas Maar, Lorenz Schumm, Rene Denifl, Lukas Treffner and Stefan Mangard now shows that this convenience comes at a huge cost to security.
In all the data migration apps examined from seven Android manufacturers – Google, Samsung, Vivo, Xiaomi, Oppo, Huawei and Honor – the team found vulnerabilities that would allow them, as attackers, to manipulate the transfer or eavesdrop on it. They simply had to be within radio range of the devices – indoors, that's around 20 to 45 metres. Using inexpensive equipment costing less than 100 euros, they were able to eavesdrop on the data transfer. Places where large numbers of new mobile phones are set up every day, such as specialist electronics shops or mobile phone shops, are particularly vulnerable to such attacks.
Digital life in the spotlight
The potential risk posed by these vulnerabilities is enormous, as almost the entire contents of a smartphone are transferred during a data migration. As part of their investigation, the researchers were not only able to access text messages, contacts and photos, but also to extract highly sensitive information such as health data, login details for saved Wi-Fi (WLAN) networks and app passwords. In some cases, it was even possible to inject malware directly into the new device via app packages that had been tampered with during the transfer.
Billions of users affected – manufacturers respond
The significance of the discovery is evident from the installation figures. The apps examined have been downloaded more than 12 billion times in total and come pre-installed on almost every Android device. "Because these apps are pre-installed and are very convenient for transferring data to a new mobile phone, these security vulnerabilities have a huge impact," says Florian Draschbacher. The team at TU Graz had already reported the vulnerabilities to the manufacturers in advance as part of a responsible disclosure process. They had confirmed the severity of the issues (including five security alerts classified as high). All seven manufacturers have now released security updates to address the reported vulnerabilities. The researchers urge users, before migrating data between two smartphones, to "ensure that the latest version of the data migration app is installed on both devices, and to always install all relevant updates." In some cases, this may require updating the entire operating system.
The following Android manufacturers and data transfer apps were examined:
Google Android: Android Switch
Samsung: Smart Switch
Vivo: EasyShare
Xiaomi: Mi Mover
Oppo: Clone Phone
Huawei: Phone Clone
Honor: Device Clone
About the study:
The paper "Clone2Pwn: A Systematic Security Analysis of Data Migration Tools in the Android Ecosystem" was authored by researchers from TU Graz and A-SIT Austria and published at the European Symposium on Research in Computer Security (ESORICS) 2026.
Successful cybersecurity research at TU Graz
This study is the latest in a series of globally significant cybersecurity risks that have been identified by the Institute of Information Security at TU Graz. For example, a team from the institute was involved in the discovery of the security vulnerabilities Meltdown and Spectre , which affected the vast majority of modern computer processors. In 2024, researchers discovered SnailLoad , which allows users' online activities to be monitored by comparing the latency times of internet connections with the digital fingerprint of online content. They also discovered the attack method Collide+Power , in which an analysis of a computer processor's energy consumption makes it possible to read data from its memory. However, the institute is also conducting research in the opposite direction. The Ascon algorithm developed by Maria Eichlseder, Christoph Dobraunig, Florian Mendel and Martin Schläffer, was designated the international standard for lightweight cryptography in 2023. In April 2026 TU Graz opened the Cybersecurity Campus Graz , a new facility dedicated to cutting-edge research and teaching in the field of IT security.
