We caught technicians at Best Buy, Mobile Klinik, Canada Computers and others snooping on our personal devices
When you need to drop off your tech devices for a repair, how confident are you that they won't be snooped on?
CBC's Marketplace took smartphones and laptops to repair stores across Ontario — including large chains Best Buy and Mobile Klinik — and found that in more than half of the documented cases, technicians accessed intimate photos and private information not relevant to the repair.
Marketplace dropped off devices at 20 stores, ranging from small independent shops to medium-sized chains to larger national chains, after installing monitoring software on the devices. In total, 16 stores were recorded. (At four stores, the tracking software didn't log anything, or the stores didn't appear to turn the devices on.)
Technicians at nine stores accessed private data, including one technician who not only viewed photos but copied them onto a USB key.
Unsurprising. Most repair shops will ask for your PW to "test that the device works". If it is for a battery change, or screen fix or whatnot, refuse to give it! It is not required. They can confirm the fix just by accessing the lock screen itself.
Shitty people will do shitty things. That said, if you don't give your password, be prepared to have the technician test all sorts of stuff in front of you. The selfie camera, ear speaker, microphone, etc. sometimes are mounted on the screen. If there are problems, the tech will need to redo the repair. Not advocating for giving your pw, but be prepared for the process to be less convenient.
Edit: My bad, should have clarified I'm talking about phones exclusively. If you're worried about your computer, create a non-admin user and give them that password. If they had the skills to bypass that, they wouldn't be working at a repair shop.
What are you talking about? I worked at a geek squad back in college days and no one there needed your admin password to get into your computer. We'd just remove the password. The only reason we asked for your password was so you'd get your computer back with the password still on it, lol...
I'm more shocked that none of the techs found the monitoring software and assumed it was something malicious and disabled or removed it...
Bitlocker? FileVault? If you're cracking those, why the fuck are you working at a Best Buy?
Bitlocker or Filevault for the pin/password to get onto your computer? I don't think that'll be a common scenario. I also imagine they bypass the whole password thing, rather than cracking the actual password.
Yup. A majority of the time people didn't have any of that setup anyway. But also most of windows security is centered around external attacks over a network, not someone actually having your computer so there are lots of ways to just remove the password if you can plug in a flash drive or insert a CD.
If someone actually security conscious brought in a computer truly locked down, we would have had a tough time of it, but people that know how to do that aren't bringing their computer to geek squad to be fixed, so it's a catch 22.
Yeah I had a buddy who bought a PC that had a BIOS password on it(which now I realize was probably stolen.. but it was like a big box store 2010 desktop which is weird to steal) I was surprised with how easy it was to bypass that, and gain access with a flash drive and 3 minutes of googling
If someone has physical access to your device, they also have the ability to access your files without your password. Unless you are using sophisticated full disk encryption, but that makes it more time consuming to gain access.
I wish Android still had full-disk encryption. It was dropped in Android 10 for file-based encryption, but as far as I know the keys are just somewhere on the device. But I am not sure about that. Like 10%.
They'll be in a hardware security module, just like the computer should be storing encryption keys with the tpm. Tbh I don't know what's actively implemented but definitely on the devices I manage in MDM they're non-compliant without that. I'm sure you probably can get cheap devices without though. Just like you can get home level laptops without tpm.
What it was really dropped? 😱
A lot of times, the camera/earpiece speaker/microphone cables are really fragile and tolerances are tight. The phone isn't designed to be opened. You should, therefore, make sure they work after the repair by making a test call.
You almost always need to the password to test a phone thoroughly. You can see that the screen works on the lock screen, but what about the front facing camera, and secondary microphone that are attached to the screen and need to be transferred, or replaced if you do it like Apple. On newer iPhones the slightest defect can cause face id to not work. On laptops it depends. Sometimes live USBs don't have the right drivers to test all the hardware. When you assume things are simple you're usually wrong.
Weird that you'd mention the cameras, one of the only things you can access from the lock screen.
For everything but data recovery you can get by fine without a password. You aren't gonna have a hardware issue that makes Facebook slightly slower, your device won't turn on.
Incorrect. On most devices after the power is cycled you can't use the camera on the lockscreen. You have to enter the password once before that feature is enabled. And if you're doing a screen replacement you need to power it off or you risk frying the backlight. How many cellphones have you repaired? 1? Hundreds? Thousands? It was my job for years, and my point is just don't assume things are simple.