WaveSecure

Losing your Android phone, whether accidentally or through theft, is one of the easiest ways to become a victim of identity theft. Suddenly, handy features such as your integrated e-mail, contacts, and calendar can be used against you by strangers. Although Android phones have built-in security functions (go to the Settings menu and select Security) such as the ability to lock the phone and require a password after a specified period of inactivity, many people disregard them because it’s a little less convenient to have to unlock the phone with each use.

But oh, the price of convenience! Imagine what damage a malicious person could do if they had unfettered access to your work e-mail and contacts. WaveSecure (free seven-day trial; $20 yearly subscription) gives you a way to lock down your phone remotely, and even to wipe some–but not all–of your personal data if your handset is lost or stolen.

Setup is simple. After installing the app, run it, agree to the Terms of Service, enter your phone’s number, enter a “buddy” phone number (WaveSecure will text this number with a notification in case you lose your handset), and pick a six-digit PIN. Make sure to remember the PIN (as well as your phone number), because these will be your login credentials for the service.

Once you have done that, you see a home screen with five options: Backup, Upload Media, Restore, Lock Down Phone, and Wipe Now. Each option opens into a menu page when you select it.

Backup allows you to sync SMS messages, contacts, and call logs to the Web. You can choose to back up all three, or just one. You can also elect to have the app back up automatically on a daily basis so that you don’t have to think about it. Unfortunately, WaveSecure does not back up apps, widgets, wallpaper, or other custom user settings, so don’t expect to be able to restore a new replacement device to the same configuration as the one you lost. (That would be a nice option to have, however, considering that the app is targeted toward people who lose their phone.)

Upload Media is similar to Backup, but works with images and videos instead. You can select individual photos or videos, or choose to upload all photos. This function, however, is strictly manual, with no option for automatic uploads. I found, too, that the upload-all action resulted in several ‘network errors’ or failed uploads. The app doesn’t retry failed uploads, so you have to redo them manually. Also, WaveSecure doesn’t allow document uploads–an unfortunate omission of a feature that business users would probably want to have.

Restore permits you to download the SMS items and contacts you previously backed up. It does not, however, allow you to download media or call logs. This is an odd and disappointing choice–why allow upload but not download?

Lock Down Phone presents a lock screen that displays your “buddy” contact phone number. You can unlock the handset with your PIN. You can also go to Menu, Settings and select Auto-lock on SIM change so that your phone locks itself if someone tries to swap out the SIM card (GSM handsets).

Be sure to treat Wipe Now, the final option, with great care. When you use the command in-app, it deletes all contacts, SMS, call logs, photos, videos, and memory card files. (Remote wiping from the Web allows more-granular, individual selection of the kinds of data to delete.) Since WaveSecure can’t back up the complete contents of your memory card (a weakness I dislike), and since it also can’t restore call logs and media, Wipe Now works as a last resort.

Keep in mind that WaveSecure will not completely reset the device to factory settings. Only the data mentioned above will be deleted; e-mail and account credentials will not be deleted. That’s fine if the WaveSecure lock holds, but if a hacker were to figure out a way past it, you could have problems. If you lose your phone, changing your account passwords immediately is still prudent.

The Wipe Now option will not completely overwrite your storage card, either, meaning that a determined hacker with commonly available recovery software could still get files from it. Chee Wee Lee of Team WaveSecure has this to say about storage card deletion: “To completely overwrite every bit of the card takes an extremely long time and runs the risk of the operating system terminating process, because it’s quite a resource-heavy operation. Also, if the battery runs out of juice, users will be unable to locate their devices. That said, we have on our product road map to introduce this secure wipe option so users can have a choice with either deletion.”

Naturally, the most important feature of WaveSecure is the ability to remotely track and control your phone after you lose it. The Web service, accessible through a desktop browser (not an Android one, though), allows you to lock, back up, and wipe (in the manner previously mentioned) your phone. It can take a significant amount of time for the lock command to take effect on the phone, though, and in my tests the command would occasionally fail altogether (the Web app did notify me, so I could retry). Meanwhile, I had plenty of time to use the phone, make a backup copy of my contacts, and e-mail it. That window of time could spell trouble for phone owners who don’t enable the native Android screen lock.

You can also send a text message to your phone to trigger the lock, locate, or wipe functions. You can access the documentation in-app by going to Menu, Help, or you can find it on the WaveSecure Website.

WaveSecure may appeal to the average user who wants to be able to remotely lock and track their phone, back up and delete selected data, and provide a contact number for anyone who finds the phone. However, I don’t recommend it as an enterprise-grade security tool, because it won’t completely wipe the phone or storage card, nor can it completely restore all data and settings to a new replacement phone. Since WaveSecure is owned by antivirus software company McAfee, I expect better performance than this Android app currently provides. I also expect a large company like McAfee to be able to muster the development resources to take this app to the next level.

If you decide to try this app, you should also install the companion app WaveSecure UninstallProtection, which will lock your phone if someone tries to get around WaveSecure by uninstalling it before you have a chance to lock your phone remotely. It works just as advertised.

Know of an enterprise-grade Android security app with full backup, wipe, and restore capability? Contact me on Facebook or Twitter (@brentpcw).