The researchers behind the study, Florian Draschbacher, Lukas Maar, Lorenz Schumm, Rene Denifl, Lukas Treffner and Stefan Mangard, examined the migration apps bundled by seven Android manufacturers: Google’s Android Switch, Samsung’s Smart Switch, Vivo’s EasyShare, Xiaomi’s Mi Mover, Oppo’s Clone Phone, Huawei’s Phone Clone and Honor’s Device Clone. In every single tool they analysed, they identified weaknesses that allowed them, acting as attackers, to either eavesdrop on the data being transferred or to manipulate it while it was in motion. None of the seven apps emerged unscathed, which suggests the problems are systemic rather than the result of isolated programming mistakes by any one company.

The technical reason these attacks are possible lies in how the migration tools are designed. To avoid dependence on external servers or cloud services, the apps establish a direct Wi-Fi connection between the two smartphones involved in the transfer. This peer-to-peer approach is convenient and fast, but it also means the data is broadcast over the air in a form that, in the implementations studied, was not adequately protected. An attacker who positions themselves within radio range of the two devices can passively observe the traffic or, in some scenarios, actively interfere with it. Indoors, the researchers found that range extends to roughly 20 to 45 metres, which means an adversary does not need to be in the same room to exploit the flaw. Using equipment costing less than 100 euros, the team was able to capture the data streams during a migration.

The sensitivity of what crosses that wireless link during a migration is what makes the findings so consequential. Unlike a single compromised app or account, a data migration moves nearly the entire contents of a smartphone at once. In their experiments, the researchers were able to read text messages, contacts and photographs, but also far more valuable material: health data, stored credentials for Wi-Fi networks, and passwords saved within apps. In some cases they could go beyond passive observation entirely, injecting malware into the new device by tampering with app packages as they were transferred. This transforms the migration moment from a mere privacy risk into a potential full compromise of the target phone, since malware introduced this way would arrive disguised as legitimate software the user had deliberately moved to their new device.

Locations where many people set up new phones in quick succession deserve particular attention. Electronics retailers and mobile phone shops, where staff routinely perform migrations for customers on the premises, could become attractive hunting grounds for attackers, since a single afternoon in such a location might expose multiple transfers. The researchers highlight this concentration effect as one of the more practical dangers arising from the vulnerabilities, because it lowers the effort required for an attacker to find victims compared with waiting for individual users to migrate their data at home.

The scale of exposure is difficult to overstate. The apps examined have collectively been downloaded more than 12 billion times, and because they come pre-installed on almost every Android device, most users have never made a conscious choice to install them or even to think about them. As Draschbacher notes, this combination of pre-installation and convenience is precisely what gives the vulnerabilities such reach. A flaw in an obscure app that users must actively seek out affects a self-selected minority; a flaw in the default migration path affects essentially everyone who upgrades their phone, which is to say nearly the entire Android user base over time.

Before publishing, the Graz team followed a responsible disclosure process, reporting the vulnerabilities to the affected manufacturers in advance so that fixes could be prepared. All seven manufacturers confirmed the severity of the issues, with five of the security alerts classified as high severity, and all have since released security updates addressing the reported problems. This coordinated response means that the practical risk to users today depends heavily on whether their devices are up to date. The researchers’ advice to anyone planning a migration is to ensure that the latest version of the data migration app is installed on both the old and the new device before starting the transfer, and to install all relevant updates. In some cases, this may require updating the entire operating system first, since the migration app and the underlying system components it relies on may both have received fixes.

The study, titled Clone2Pwn: A Systematic Security Analysis of Data Migration Tools in the Android Ecosystem, was presented at the European Symposium on Research in Computer Security, known as ESORICS, in 2026. The systematic nature of the analysis is notable: rather than examining a single app in depth, the team built a comparative methodology that could be applied across the whole ecosystem of migration tools, which is how they were able to demonstrate that the weaknesses recur across vendors that compete fiercely with one another. Findings of this kind often prompt broader questions about how such pre-installed system components are audited, since they typically receive less public scrutiny than flagship apps distributed through app stores.

The work also fits into a longer record of security research from TU Graz’s Institute of Information Security. Researchers there were involved in the discovery of Meltdown and Spectre, the processor vulnerabilities that affected the vast majority of modern computer chips. In 2024, the institute’s researchers described SnailLoad, an attack that monitors users’ online activity by comparing the latency patterns of internet connections against the digital fingerprints of online content. They also identified Collide+Power, a method in which analysing a processor’s energy consumption allows data to be read from memory. The institute’s work is not limited to finding attacks: the Ascon algorithm, developed by Maria Eichlseder, Christoph Dobraunig, Florian Mendel and Martin Schläffer, was designated the international standard for lightweight cryptography in 2023. In April 2026, TU Graz opened the Cybersecurity Campus Graz, a new facility dedicated to advanced research and teaching in IT security, underscoring the institutional commitment behind studies of this kind.

For everyday users, the practical takeaway is relatively simple but easy to overlook. The moment of switching phones feels private and routine, yet it is one of the few times when a device’s complete contents are transmitted over an unprotected local wireless link. Updating both devices before the transfer, performing migrations in trusted environments rather than in public or commercial spaces, and treating the migration app itself as software that needs patching like any other are all reasonable precautions. The study serves as a reminder that convenience features built into the core of an operating system deserve the same security attention as any third-party software, and that the wireless protocols used during device-to-device transfers must be designed with an adversarial observer in mind from the outset.

Subject of Research: Security vulnerabilities in Android smartphone data migration tools

Article Title: TU Graz uncovers major security flaws in data migration tools

Article References: TU Graz uncovers major security flaws in data migration tools. (n.d.). Original publication

Image Credits: AI Generated

DOI: Not provided

Keywords: Android, data migration, smartphone security, Wi-Fi eavesdropping, phone cloning, cybersecurity, TU Graz, ESORICS 2026, malware injection, responsible disclosure, Graz, uncovers

The core insight behind BTFA is that human interaction with a mobile device carries a behavioral signature as distinctive as a fingerprint, but one that requires no special hardware, no scanning, and no additional action from the user. When someone types a password on a touchscreen, the rhythm of their taps, the pressure they apply, the size of their touch contacts, and the micro-movements of the device in their hand all combine into a pattern that is difficult for an impostor to replicate even when the password itself has been compromised. BTFA captures these signals during the ordinary act of logging in and feeds them to a machine learning model that decides, in real time, whether the observed behavior matches the enrolled owner. If it does, the login proceeds seamlessly; if it does not, the system can demand additional verification or block access entirely.

Technically, the researchers turned to a Long Short-Term Memory network, a class of recurrent neural architecture well suited to sequential data. Touch gestures and sensor readings arrive as time series, and LSTM networks excel at learning the temporal dependencies within such sequences—the way one tap flows into the next, how accelerometer and gyroscope values oscillate as a hand steadies a phone. The team trained separate models on touch interaction data and on motion sensor data collected during login, allowing them to compare which modality carried the stronger authentication signal. This design choice matters because behavioral biometrics are inherently noisy: a user may be seated on a train one day and standing in a corridor the next, and the system must tolerate that natural variability while still rejecting an attacker with surgical precision.

To evaluate the approach under realistic conditions rather than in a sterile laboratory setting, the team conducted a field study using a custom-developed mobile application with registration and login interfaces. Participants used the app in their daily lives, generating a substantial corpus of 38,542 behavioral samples that were used for model training and validation. Field data of this kind is considerably harder to model than curated laboratory recordings, precisely because it contains the posture changes, device swaps, and environmental distractions of real-world use. The scale of the dataset also matters for deep learning: LSTM networks require enough examples to generalize across sessions and days rather than memorizing individual recordings, and the collected volume gave the models that opportunity.

The results revealed a striking asymmetry between the two behavioral modalities. The model trained on sensor data—accelerometer and gyroscope readings captured while the user interacted with the login screen—achieved an area under the ROC curve of 97.28 percent, with an equal error rate of just 6.84 percent. The touch gesture model, by contrast, reached 78.67 percent AUC with an equal error rate of 28.48 percent. The researchers attribute the gap primarily to the stability of motion patterns: the way a person’s hand trembles, tilts, and counterbalances during typing is remarkably consistent across sessions, whereas touch characteristics such as tap duration and swipe geometry fluctuate more with context, device position, and even mood. In practical terms, the sensor channel alone provides a second authentication factor strong enough to meaningfully complement a password.

Equal error rate deserves a moment of explanation, because it is the figure of merit by which biometric systems are judged. It is the point at which the system’s false rejection rate—legitimate users wrongly locked out—equals its false acceptance rate—impostors wrongly waved through. A lower EER means the threshold can be tuned so that both errors are rare simultaneously. An EER of 6.84 percent for the sensor-driven model means that security administrators can calibrate BTFA to reject the vast majority of attackers while inconveniencing only a small fraction of legitimate users, a trade-off that compares favorably with many published behavioral biometric systems evaluated under similar conditions.

What makes BTFA particularly relevant for Identity and Access Management systems is its resistance to phishing and its zero-burden design. Phishing remains one of the most successful attack vectors in enterprise environments: a user is tricked into entering credentials on a fraudulent site, handing the attacker everything needed to impersonate them. But stolen credentials alone are useless against BTFA, because the attacker logging in from their own device or an automated script will not reproduce the victim’s hand movements and sensor signatures. Unlike SMS one-time passwords, which can be intercepted through SIM swapping, or push-based approval, which users can be manipulated into accepting through fatigue attacks, behavioral verification cannot be forwarded, replayed, or socially engineered out of the user. The second factor exists only in the physical act of the legitimate owner logging in.

The user-experience implications are equally significant. Surveys of multi-factor adoption consistently find that friction is the primary reason users disable or circumvent second factors, and organizations under regulatory pressure to enforce MFA often face pushback when the added security slows daily workflows. BTFA inverts this equation: the second factor is collected passively as a byproduct of the login the user was going to perform anyway. There is no code to read, no token to carry, no notification to approve. The researchers emphasize that this reduction in user dependency on the MFA solution is especially valuable in IAM applications where critical and confidential information is accessed and shared, since those environments demand both stringent security and sustained user cooperation.

The work builds on a growing body of research into behavioral biometrics and continuous authentication on mobile devices, and the authors position BTFA as a pragmatic deployment model for that science—one that targets the specific, high-value moment of login rather than demanding background monitoring throughout a session. The study’s limitations are those of the field generally: behavioral patterns can drift over time as users’ habits change, models must be retrained or adapted to accommodate new devices, and privacy considerations around collecting motion data require careful governance. Yet the field study’s results suggest that the technical barriers are surmountable with data already being generated by every tap. As organizations worldwide retire passwords in favor of phishing-resistant authentication, BTFA offers a vision of security that asks nothing extra of the user—because the strongest proof of identity, it turns out, may simply be the way you hold your phone.

Subject of Research: Behavioral biometric two-factor authentication for Identity and Access Management systems

Article Title: BTFA: Behavioral Two Factor Authentication For IAM Systems

Article References: Mahfouz, A., ALMouh, K., Samrouth, K., Bakir, N., & Chalhoub, G. (2026). BTFA: Behavioral Two Factor Authentication For IAM Systems. Mobile Networks and Applications. https://doi.org/10.1007/s11036-026-02515-7

Image Credits: AI Generated

DOI: 10.1007/s11036-026-02515-7

Keywords: behavioral biometrics, two-factor authentication, IAM systems, LSTM, touch gestures, sensor data, smartphone security, phishing resistance, user authentication, machine learning, mobile security, identity and access management