Cybersecurity specialists have purportedly uncovered severe vulnerabilities within smartphone data transfer applications supplied by seven major global brands, allegedly allowing unauthorized third parties to intercept private photos, messages, and stored passwords in close proximity.
Researchers from the Institute for Information Security at Graz University of Technology in Austria, alongside the Secure Information Technology Center, conducted comprehensive evaluations of proprietary applications from the targeted brands. Their findings were reportedly presented at the ESORICS 2026 international computer security symposium, focusing on applications designed to facilitate wireless content migration between legacy and new mobile devices using direct Wi-Fi links.
During experimental simulations, the researchers demonstrated that inherent flaws within the transfer pipeline enable data interception and active manipulation. According to the disclosures, an attacker allegedly needed only to remain within wireless range—approximately 20 to 45 meters—utilizing off-the-shelf equipment valued at under 100 euros to compromise the exchange.
The testing phase reportedly yielded unauthorized access to SMS messages, contact lists, personal photographs, health-related records, application-stored passwords, and Wi-Fi network credentials. In certain observed scenarios, the investigators also identified the capability to substitute installation packages during the transfer process and inject malicious software onto the newly provisioned smartphone.
Industry observers note that the identified risk does not pertain to standard daily device operations, but rather exclusively targets the specific context of data migration via vulnerable software pipelines. This raises substantial concerns for consumer electronics retail stores and mobile carrier outlets where staff routinely assist customers with device setup and data migration services.
The researchers reportedly disclosed their findings to the affected vendors beforehand, providing an allocation window to develop necessary security patches. Following the coordinated disclosures, the manufacturers purportedly addressed the flaws, though experts continue to advise users to update operating systems and migration utilities prior to executing data transfers.
Source: kun.uz