Before you sell your old Android phone, its generally a good idea toencrypt and then wipe your phone.
So be careful who you give your old phones to.
The reason for this vulnerability varies.
In some cases, its the fault of OEMs not including proper drivers to perform secure erases.
In other cases, its the fault of the Android OS.
While this study emphasizes the point, its also worth mentioning that this isnt entirely new information.
You could even justrepurpose it yourself.
Flawed Android factory reset leaves crypto and login keys ripe for picking| Ars Technica