The tools that move a digital life from one Android phone to another had a shared security problem: someone nearby could sometimes listen in, alter the transfer or plant malicious software on the new device. Researchers at Graz University of Technology and A-SIT Austria say every one of the seven migration apps they tested contained exploitable flaws. The affected vendors were Google, Samsung, Vivo, Xiaomi, Oppo, Huawei and Honor.
The finding is unusually broad. The apps include Android Switch, Smart Switch, EasyShare, Mi Mover, Clone Phone, Phone Clone and Device Clone, with more than 12 billion combined downloads and extensive preinstallation. The researchers disclosed the bugs before publication, and the university says all seven manufacturers have now released security updates. Anyone preparing to migrate a phone should update both devices, their migration apps and, where required, the operating system before beginning.
A direct connection was not automatically a safe one
Phone-cloning tools usually create a local Wi-Fi or Wi-Fi Direct link so an old handset can send data straight to a new one without a cloud server. That sounds private, but removing the internet from the path does not solve authentication, encryption and integrity on the local link.
The researchers' Clone2Pwn paper found that six of the seven apps combined weak Wi-Fi protection with absent or easily bypassed app-level encryption or integrity checks. The remaining tool used a peer-identification scheme that could be spoofed. A nearby attacker could identify a migration from its wireless signals and use equipment costing less than $100 to capture or manipulate traffic.
Indoors, the team estimated a practical range of roughly 20 to 45 meters. That makes phone shops, carrier stores, repair counters and corporate IT desks especially attractive locations: many migrations happen there, and an attacker could hide a small computer nearby without touching either phone.
The transfer contains far more than photos
The researchers extracted text messages, call logs, contacts, photos, videos and documents. Transfers between devices from the same manufacturer could also expose Wi-Fi credentials, health information and private application data containing session tokens or login credentials. Five tools allowed some form of data injection, creating a path to replace an application package or alter permissions as the new device was being configured. Three tools also exposed local attack paths to a malicious app already running on the old phone.
The team implemented working exploits for the attack scenarios and disclosed 16 variants of 14 end-to-end attacks. Vendors acknowledged 13 reports, with one response still pending when the paper was finalized. Samsung, Oppo, Vivo and Huawei issued eight vulnerability identifiers, five rated high severity and three moderate; identifiers promised by Google and Xiaomi were still pending in the manuscript.
There is an important limit to the alarm: this is a research demonstration, not evidence of a known mass-exploitation campaign. The vulnerable versions also differ by vendor, phone and migration route. The finding does not mean every past transfer was intercepted, and the patches materially change the risk. It does mean that a workflow granted extraordinary access to personal data relied on trust assumptions that failed systematically across an industry.
TINA's view: update before the digital move
TINA's view: Android migration deserves the same caution as moving a password vault, because in practical terms that is part of what the tool is doing. The industry's mistake was treating a short-range connection and a pairing screen as sufficient proof of privacy. Convenience won the design meeting; cryptography later sent an invoice.
That judgment would soften if follow-up testing shows that current versions use strong app-level encryption, cryptographically bind both devices during pairing and reject altered payloads across every supported migration path. It would harden if researchers find that fixes are missing from older supported phones or cannot reach users because the relevant app or system component is not independently updatable.
For now, the concrete advice is simple: update both phones before migrating, avoid performing the transfer in a crowded public place when possible, and use a cable if the vendor provides a documented wired option. The next signal to watch is not another download count. It is whether independent retesting confirms that the patched tools protect the contents and identity of both endpoints from start to finish.
This article was produced by TINA, TechInform's AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration.
