{"id":47715,"date":"2023-04-03T08:36:36","date_gmt":"2023-04-03T12:36:36","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=47715"},"modified":"2023-04-03T08:37:17","modified_gmt":"2023-04-03T12:37:17","slug":"repair-shops-privacy-issues","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/repair-shops-privacy-issues\/47715\/","title":{"rendered":"What really goes on when your device is in repair"},"content":{"rendered":"

Probably everyone has damaged their smartphone, tablet or laptop and needed it repaired at least once in their lives. The cause of the damage may be the user\u2019s own sloppiness: replacing broken smartphone screens brought countless billions of dollars to the industry. But more often, it\u2019s just a random malfunction like the battery failing, the hard drive dying, or a key coming off the keyboard. And this can happen at any time.<\/p>\n

Unfortunately, modern devices are made in such a way that even the handiest of computer wizards are often unable to fix them on their own. The repairability of smartphones is steadily decreasing from year to year. To fix the latest models, it takes not only skill and a general understanding of how all sorts of digital gizmos work; you also now need specialist tools, expertise, and access to documentation plus unique spare parts.<\/p>\n

Therefore, when a smartphone or laptop breaks, the user usually has little choice other than finding a service center. After all, simply throwing out your broken device, buying another and starting over normally isn\u2019t an option because you\u2019d probably like to recover all the data that was on it. So, it\u2019s over to the service center you head. But there\u2019s a problem: you have to pass your device into the hands of a stranger. Photos and videos, correspondence and call history, documents and financial information can all end up being directly accessible by somebody you don\u2019t know. Can this person be trusted?<\/p>\n

Homemade porn viewings at repair shops are a thing<\/h2>\n

I personally gave this some serious thought recently after what a friend of mine told me. He\u2019d had an informal chat with some guys working at a small repair shop. They told him without any hesitation how they occasionally held viewings of homemade porn found on the devices they repair for employees and their friends!<\/p>\n

Similar incidents pop up in the news from time to time. Employees stealing<\/a> private photos of customers have been found in more than one service center<\/a>. And sometimes even bigger stories<\/a> emerge: in one case, service-center employees not only stole photos of female customers for years, but also put together entire collections of them and shared them.<\/p>\n

But, surely such incidents are exceptions to common practice? Not every service center has staff eager to get their hands on customers\u2019 personal data, right? Unfortunately, results of a study<\/a> I recently came across show that breaches of customer privacy by maintenance technicians are a much more common problem than we would all like to think. In fact, it seems highly likely that excessive curiosity on the part of repair staff is a feature of this industry rather than isolated outrageous incidents. But let\u2019s not get ahead of ourselves. I\u2019ll take you through it all step by step.<\/p>\n

How electronics repair services treat their customers\u2019 data<\/h2>\n

A study was conducted by researchers at the University of Guelph in Canada. It consists of four parts, two of them devoted to the analysis of conversations with customers of repair services, and two were field studies in service shops themselves (which I will focus on here). In the first of the \u201cfield\u201d parts, the researchers tried to find out how repair shops treat privacy in terms of their intentions. First and foremost, the researchers were interested in what privacy policies or procedures the service shops had in place to safeguard customers\u2019 data.<\/p>\n

To do this, the researchers visited nearly 20 service shops of various types (from small local repairers to regional and national service providers). The reason for each visit was to replace the battery in an ASUS UX330U laptop. The reason behind the choice of malfunction was simple: diagnosing the problem and solving it does not require access to the operating system, and all the necessary tools for this are in the laptop\u2019s UEFI<\/a> (the researchers use the old-fashioned term BIOS).<\/p>\n

The researchers\u2019 visits to the service centers involved several steps. First, they looked for any information readily available to the customer regarding the service center\u2019s data privacy policy. Second, they checked to see if the employee taking the device would request the username and password to log in to the operating system and, if so, how they would justify the need to hand that information over (there\u2019s no obvious reason for this because, as stated, battery replacement doesn\u2019t require access to the operating system). Third, the researchers noted how the password for the device being handed over for repair was stored. Finally, fourth, they asked the employee accepting the equipment a direct and unambiguous question: \u201cHow do you make sure no one will access my personal data?\u201d to find out what privacy policies and protocols were in place. <\/p>\n

The results of this part of the study were disappointing.<\/p>\n