pith. sign in

arxiv: 2606.06181 · v2 · pith:YULFT6F5new · submitted 2026-06-04 · 💻 cs.CR

Opportunities and Challenges in Securely Reusing and Repurposing Mobile Devices

Pith reviewed 2026-06-28 00:37 UTC · model grok-4.3

classification 💻 cs.CR
keywords mobile device securitydevice repurposingtrusted execution environmentboot chain integrityhardware-bound secretsvendor lock-inelectronic wastecybersecurity
0
0 comments X

The pith

Vendor-locked security in phones makes secure repurposing difficult for most discarded devices.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper tests whether built-in phone security features, such as boot chain checks and trusted execution environments, continue to provide protection once a device leaves its original vendor ecosystem. Experiments on an open-hardware phone simulate realistic reuse cases and show that rebuilding the required trust anchors is complex. From these observations the authors derive general requirements that would allow secure repurposing and demonstrate that vendor controls block reuse for the great majority of existing phones. A sympathetic reader would care because billions of phones become e-waste each year, and the work asks whether their security design prevents a practical second life.

Core claim

Security mechanisms that rely on vendor-controlled provisioning and fixed device lifecycles do not remain effective when devices are repurposed outside their original ecosystem. Experiments on the PinePhone reveal the difficulty of reconstructing trust anchors for boot integrity, trusted execution environment isolation, and hardware-bound secrets. These findings generalize to requirements for secure repurposing and show that vendor-locked mechanisms prevent safe reuse of most discarded devices.

What carries the argument

Hardware-backed security mechanisms (boot chain integrity, trusted execution environment isolation, and protection of hardware-bound secrets) that depend on vendor-controlled provisioning.

If this is right

  • Secure repurposing requires explicit mechanisms to reconstruct or transfer trust anchors after the device leaves its original ecosystem.
  • Vendor-locked provisioning prevents the majority of discarded phones from being safely repurposed.
  • New design requirements are needed so that future phones can support both original use and later reuse without loss of security.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If vendor locks remain the norm, large-scale phone reuse programs will need new hardware or software layers that operate above the existing security stack.
  • The work points toward a possible tension between long device lifecycles for environmental reasons and the fixed-lifecycle assumption built into current hardware security.
  • One testable extension is whether open-source firmware projects can supply the missing trust-anchor reconstruction steps for a wider range of devices.

Load-bearing premise

Results from the open-hardware PinePhone and the simulated scenarios apply to the security behavior of typical vendor-locked phones.

What would settle it

A demonstration that trust anchors can be rebuilt on a common vendor-locked phone without weakening its original security guarantees, or a survey showing that most discarded phones can be repurposed while preserving those guarantees.

Figures

Figures reproduced from arXiv: 2606.06181 by Adelin Roty, Jan Tobias M\"uhlberg, Jean-Fran\c{c}ois Determe.

Figure 1
Figure 1. Figure 1: Typical Smartphone Boot-chain 3.4 Limitations of our study While the PinePhone provides valuable insight into TrustZone￾capable hardware reuse, it differs from mainstream commercial smartphones in several ways. First, the manufacturer keys used during secure boot checks are not fused in memory during production, allowing the end-user to replace them with custom ones if needed. Second, it does not enforce m… view at source ↗
Figure 2
Figure 2. Figure 2: Targeted Software Stack for the PinePhone in our experiments [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 4
Figure 4. Figure 4: Logs of a Successful U-Boot launch was sufficiently stable to support interactive use and basic reg￾ular operations such as SSH connection through the serial port, interaction with the filesystem, basic scripting,... This setup is representative of regular smartphones recycling projects, where the device original software stack is replaced with a custom bootloader and a Linux image to provide a generic em￾… view at source ↗
Figure 5
Figure 5. Figure 5: Software Stack achieved on a PinePhone mappings, peripheral assignments, or bootloader settings can pre￾vent the device from correctly enforcing isolation or executing a TEE. Integrating a TEE proved considerably more challenging than de￾ploying a functional Linux system. Correctly mapping secure mem￾ory regions and defining safe zones requires low-level expertise, and errors can easily lead to kernel cras… view at source ↗
read the original abstract

An estimated 5.3 billion mobile phones became electronic waste in 2022. Many of these devices can be repurposed and used in different contexts to extend their lifetime and to reduce ecological impacts. An often overlooked aspect of smartphone reuse is cybersecurity: these devices embed hardware-backed security mechanisms that rely on vendor-controlled provisioning and are designed for a fixed device lifecycle. In this paper, we investigate whether security mechanisms and guarantees remain effective when devices are repurposed outside their original ecosystem. We explore security features in a PinePhone, an open-hardware smartphone, and focus on three core security aspects: boot chain integrity, isolation provided by the Trusted Execution Environment, and the protection of hardware-bound secrets. Our experiments simulate realistic repurposing scenarios and highlight the complexity of reconstructing trust anchors. We generalize our observations to infer requirements for secure repurposing and illustrate how vendor locked mechanisms hinder the repurposing of a majority of discarded devices.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

1 major / 0 minor

Summary. The paper investigates cybersecurity challenges in repurposing discarded mobile devices, focusing on hardware-backed security mechanisms designed for fixed lifecycles. Using experiments on the open-hardware PinePhone, it examines three aspects—boot chain integrity, Trusted Execution Environment (TEE) isolation, and protection of hardware-bound secrets—under simulated repurposing scenarios. The work highlights difficulties in reconstructing trust anchors, derives requirements for secure repurposing, and concludes that vendor-locked mechanisms hinder repurposing for the majority of devices.

Significance. If the generalization from open-hardware experiments holds, the paper would usefully identify concrete barriers to secure device reuse, supporting efforts to reduce e-waste through extended lifecycles while maintaining security guarantees. The focus on trust-anchor reconstruction in realistic scenarios provides a starting point for requirements engineering in this area.

major comments (1)
  1. [Abstract] Abstract and concluding sections: the claim that 'vendor locked mechanisms hinder the repurposing of a majority of discarded devices' rests on generalization from PinePhone (open-hardware) experiments. Because the tested device lacks vendor provisioning, attestation, and revocation mechanisms, the observed behaviors in boot-chain integrity, TEE isolation, and hardware-bound secrets do not directly measure the hindrance mechanisms asserted for locked devices; additional evidence or explicit qualification is required for this load-bearing inference.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We thank the referee for the constructive feedback. We address the single major comment below.

read point-by-point responses
  1. Referee: [Abstract] Abstract and concluding sections: the claim that 'vendor locked mechanisms hinder the repurposing of a majority of discarded devices' rests on generalization from PinePhone (open-hardware) experiments. Because the tested device lacks vendor provisioning, attestation, and revocation mechanisms, the observed behaviors in boot-chain integrity, TEE isolation, and hardware-bound secrets do not directly measure the hindrance mechanisms asserted for locked devices; additional evidence or explicit qualification is required for this load-bearing inference.

    Authors: We agree that the PinePhone experiments do not directly replicate vendor provisioning, attestation, or revocation, as these are absent by design on open hardware. The manuscript selects the PinePhone precisely to isolate and observe the core mechanisms (boot chain, TEE isolation, hardware-bound secrets) without vendor controls, then contrasts these observations with documented vendor practices for locked devices that bind trust anchors to a fixed lifecycle. To address the concern, we will revise the abstract and conclusion to add explicit qualification: the generalization is derived from the experimental demonstration of trust-anchor reconstruction complexity together with analysis of how vendor mechanisms typically prevent such reconstruction. This supplies the requested qualification while acknowledging the limits of direct experimentation on closed devices. revision: yes

Circularity Check

0 steps flagged

No significant circularity; purely experimental and observational

full rationale

The paper reports direct experiments on boot-chain integrity, TEE isolation, and hardware secrets using the PinePhone, then draws qualitative inferences about repurposing requirements and vendor-locked devices. No equations, fitted parameters, self-definitional constructs, or load-bearing self-citations appear in the derivation chain. The generalization step is an explicit inference from observed data rather than a reduction to inputs by construction. This matches the default case of a self-contained experimental study.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

Paper is abstract-only with no technical derivations, parameters, or formal models; no free parameters, axioms, or invented entities are identifiable from the provided text.

pith-pipeline@v0.9.1-grok · 5696 in / 1044 out tokens · 29620 ms · 2026-06-28T00:37:19.245237+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

59 extracted references · 23 canonical work pages · 1 internal anchor

  1. [1]

    Android. 2026. Verified Boot. https://source.android.com/docs/security/features/ verifiedboot

  2. [2]

    Arm. 2021. Arm CCA Security Model 1.0. https://developer.arm.com/ documentation/DEN0096/latest/

  3. [3]

    Arm. 2025. ARM Trusted Firmware Design. https://chromium.googlesource. com/external/github.com/ARM-software/arm-trusted-firmware/+/v0.4- rc1/docs/firmware-design.md

  4. [4]

    Arm. 2025. TrustZone for Cortex-A Product Support. https://developer.arm. com/Processors/TrustZone%20for%20Cortex-A

  5. [5]

    Cornelis P Baldé, Ruediger Kuehr, Tales Yamamoto, Rosie McDonald, Elena D’Angelo, Shahana Althaf, Garam Bel, Otmar Deubzer, Elena Fernandez-Cubillo, Vanessa Forti, Vanessa Gray, Sunil Herat, Shunichi Honda, Giulia Iattoni, Vitto- ria Luda di Cortemiglia, Yuliya Lobuntsova, Innocent Nnorom, Noémie Pralat, and Michelle Wagner. 2024. THE GLOBAL E-WASTE MONIT...

  6. [6]

    BBC. 2022. E-waste: Five billion phones to be thrown away in 2022. (Oct. 2022). https://www.bbc.com/news/science-environment-63245150

  7. [7]

    Hilty, Basil Fuchs, and Yann Blum

    Jan Bieser, Linda Burkhalter, Lorenz M. Hilty, Basil Fuchs, and Yann Blum. 2021. Lifetime extension of mobile internet-enabled devices: measures, challenges and environmental implications. https://doi.org/10.34961/1741

  8. [8]

    Barbara Bigliardi, Serena Filippelli, and Ivana Quinto. 2022. Environmentally- conscious behaviours in the circular economy. An analysis of consumers’ green purchase intentions for refurbished smartphones.Journal of Cleaner Production 378 (Dec. 2022), 134379. https://doi.org/10.1016/j.jclepro.2022.134379

  9. [9]

    Buildroot. 2026. Buildroot - Making Embedded Linux Easy. https://buildroot.org/

  10. [10]

    European Environmental Bureau. 2019. Revealed: The climate cost of ’dispos- able smartphones’. https://eeb.org/revealed-the-climate-cost-of-disposable- smartphones/

  11. [11]

    Marcelo Pilotto Cenci, Estela Moschetta Eidelwein, and Hugo Marcelo Veit

  12. [12]

    2023), 1512–1528

    Composition and recycling of smartphones: A mini-review on gaps and opportunities.Waste Management & Research41, 10 (Oct. 2023), 1512–1528. https://doi.org/10.1177/0734242X231164324

  13. [13]

    Software Freedom Conservancy. 2026. Software Freedom Conservancy. https: //sfconservancy.org/

  14. [14]

    Mauro Cordella, Felice Alfieri, Christian Clemm, and Anton Berwald. 2021. Durability of smartphones: A technical analysis of reliability and repairabil- ity aspects.Journal of Cleaner Production286 (March 2021), 125388. https: //doi.org/10.1016/j.jclepro.2020.125388

  15. [15]

    Mauro Cordella, Felice Alfieri, and Javier Sanfelix. 2021. Reducing the carbon footprint of ICT products through material efficiency strategies: A life cycle analysis of smartphones.Journal of Industrial Ecology25, 2 (2021), 448–464. https://doi.org/10.1111/jiec.13119

  16. [16]

    Debian. 2026. SecureBoot - Debian Wiki. https://wiki.debian.org/SecureBoot

  17. [17]

    Vanessa Forti, Cornelis Peter Baldé, Ruediger Kuehr, and Garam Bel. [n. d.]. The Global E-waste Monitor 2020. https://hdl.handle.net/11159/652900

  18. [18]

    WEEE Forum. 2022. International E-waste Day: Of ~16 Billion Mo- bile Phones Possessed Worldwide, ~5.3 Billion will Become Waste in

  19. [19]

    https://weee-forum.org/ws_news/of-16-billion-mobile-phones-possessed- worldwide-5-3-billion-will-become-waste-in-2022/

  20. [20]

    Valentin Girard, Maud Rio, and Romain Couillet. 2025. Computing, Complexity and Degrowth: Systemic Considerations for Digital De-escalation. InWorkshop on Computing within Limits (LIMITS) 2025. arXiv. https://doi.org/10.48550/ARXIV. 2507.19070

  21. [21]

    Google. 2026. Hardware-backed Keystore. https://source.android.com/docs/ security/features/keystore

  22. [22]

    Friederike Groschupp, Mark Kuhne, Moritz Schneider, Ivan Puddu, Shweta Shinde, and Srdjan Capkun. 2023. It’s TEEtime: A New Architecture Bringing Sovereignty to Smartphones. https://doi.org/10.48550/arXiv.2211.05206

  23. [23]

    Friederike Groschupp, Moritz Schneider, Ivan Puddu, Shweta Shinde, and Srdjan Capkun. 2021. Sovereign Smartphone: To Enjoy Freedom We Have to Control Our Phones. https://doi.org/10.48550/arXiv.2102.02743

  24. [24]

    Iness Ben Guirat and Jan Tobias Muehlberg. 2025. Resistance Technologies: Moving Beyond Alternative Designs. InWorkshop on Computing within Limits (LIMITS) 2025. arXiv. https://doi.org/10.48550/ARXIV.2508.05223

  25. [25]

    Sahil Gulliani, Maurizio Volpe, Antonio Messineo, and Roberto Volpe. 2023. Recovery of metals and valuable chemicals from waste electric and electronic materials: a critical review of existing technologies.RSC Sustainability1, 5 (2023), 1085–1108. https://doi.org/10.1039/D3SU00034F

  26. [26]

    Pengwei He, Haibo Feng, Guangji Hu, Kasun Hewage, Gopal Achari, Chang Wang, and Rehan Sadiq. 2020. Life cycle cost analysis for recycling high-tech minerals from waste mobile phones in China.Journal of Cleaner Production251 (April 2020), 119498. https://doi.org/10.1016/j.jclepro.2019.119498

  27. [27]

    Hu, Chien-Hung Kuo, Lance H

    Allen H. Hu, Chien-Hung Kuo, Lance H. Huang, and Chao-Chin Su. 2017. Carbon footprint assessment of recycling technologies for rare earth elements: A case study of recycling yttrium and europium from phosphor.Waste Management60 (Feb. 2017), 765–774. https://doi.org/10.1016/j.wasman.2016.10.032

  28. [28]

    Haoyang Huang, Fengwei Zhang, Shoumeng Yan, Tao Wei, and Zhengyu He

  29. [29]

    In2024 International Symposium on Secure and Private Execution Environment Design (SEED)

    SoK: A Comparison Study of Arm TrustZone and CCA. In2024 International Symposium on Secure and Private Execution Environment Design (SEED). 107–118. https://doi.org/10.1109/SEED61283.2024.00021

  30. [30]

    Antonio Iera, Antonella Molinaro, Stefano Yuri Paratore, Giuseppe Ruggeri, and Antonella Zurzolo. 2011. Making a mesh router/gateway from a smartphone: Is that a practical solution?SOK9, 8 (Nov. 2011), 1414–1429. https://doi.org/10. 1016/j.adhoc.2011.03.004

  31. [31]

    Hanson, Christoph Becker, Mike Berners-Lee, Andrew A

    Bran Knowles, Vicki L. Hanson, Christoph Becker, Mike Berners-Lee, Andrew A. Chien, Benoit Combemale, Vlad Coroamă, Koen De Bosschere, Yi Ding, Adrian Friday, Boris Gamazaychikov, Lynda Hardman, Simon Hinterholzer, Mattias Höjer, Lynn Kaack, Lenneke Kuijer, Anne-Laure Ligozat, Jan Tobias Muehlberg, Yunmook Nah, Thomas Olsson, Anne-Cécile Orgerie, Daniel P...

  32. [32]

    Martin Lafréchoux. 2025. Practical Retrofitting for Obsolete Devices – Bridging the gap with old tech to create alternative interaction paradigms and workflows. InWorkshop on Computing within Limits (LIMITS) 2025. arXiv. https://doi.org/10. 48550/ARXIV.2508.00942

  33. [33]

    LibrePhone. 2026. LibrePhone. https://librephone.org/

  34. [34]

    Graça Martinho, Diogo Magalhães, and Ana Pires. 2017. Consumer behavior with respect to the consumption and recycling of smartphones and tablets: An exploratory study in Portugal.Journal of Cleaner Production156 (July 2017), 147–158. https://doi.org/10.1016/j.jclepro.2017.04.039

  35. [35]

    Mobian. 2026. Mobian. https://mobian-project.org/

  36. [36]

    Jan Tobias Mühlberg. 2022. Sustaining Security and Safety in ICT: A Quest for Terminology, Objectives, and Limits. InWorkshop on Computing within Limits (LIMITS) 2022. Virtual. https://doi.org/10.21428/bf6fb269.58c3a89d

  37. [37]

    Rainer Pamminger, Sebastian Glaser, and Wolfgang Wimmer. 2021. Modelling of different circular end-of-use scenarios for smartphones.The International Journal of Life Cycle Assessment26, 3 (March 2021), 470–482. https://doi.org/10.1007/ s11367-021-01869-2

  38. [38]

    Asokan, Ahmad-Reza Sadeghi, Paulo Esteves-Veríssimo, Andreas Steininger, and Thorsten Holz

    Andrew Paverd, Marcus Völp, Ferdinand Brasser, Matthias Schunter, N. Asokan, Ahmad-Reza Sadeghi, Paulo Esteves-Veríssimo, Andreas Steininger, and Thorsten Holz. 2019. Sustainable Security & Safety: Challenges and Opportunities.OASIcs, Volume 73, CERTS 201973 (2019), 4:1–4:13. https://doi.org/10.4230/OASICS. CERTS.2019.4

  39. [39]

    PINE64. 2025. PinePhone. https://pine64.org/devices/pinephone/ Section: devices

  40. [40]

    PINE64. 2025. PinePhone - linux-sunxi.org. https://linux-sunxi.org/PinePhone

  41. [41]

    PINE64. 2026. Privacy switches — PinePhone. https://pine64.org/documentation/ PinePhone/Privacy_switches/ Section: documentation

  42. [42]

    Sandro Pinto and Nuno Santos. 2019. Demystifying Arm TrustZone: A Com- prehensive Survey.Comput. Surveys51, 6 (Nov. 2019), 1–36. https://doi.org/10. 1145/3291047 Opportunities and Challenges in Securely Reusing and Repurposing Mobile Devices LIMITS ’26, June 23–25, 20, Online

  43. [43]

    postmarketOS. 2026. postmarketOS // real Linux distribution for phones. https: //postmarketos.org/

  44. [44]

    Gudino, Neena Goveas, and Shubhangi Gawali

    Challa Sai Reshwanth, Saivinay Goriparthi, Chandra Shekar R K, Lucy J. Gudino, Neena Goveas, and Shubhangi Gawali. 2023. IoT Systems Development Using Upcycled Mobile Phones: A Survey. In2023 IEEE International Conference on Recent Advances in Systems Science and Engineering (RASSE). 1–7. https://doi. org/10.1109/RASSE60029.2023.10363603

  45. [45]

    Clara Rigaud. 2025. Zombitron: towards a toolbox for repurposing obsolete smartphones into new interactive systems. InWorkshop on Computing within Limits (LIMITS) 2025. arXiv. https://doi.org/10.48550/ARXIV.2508.06354

  46. [46]

    Moritz Schneider, Ramya Jayaram Masti, Shweta Shinde, Srdjan Capkun, and Ronald Perez. 2022. SoK: Hardware-supported Trusted Execution Environments. https://arxiv.org/abs/2205.12742v1

  47. [47]

    Alon Shakevsky, Eyal Ronen, and Avishai Wool. 2022. Trust Dies in Darkness: Shedding Light on Samsung’s TrustZone Keymaster Design. In31st USENIX Security Symposium (USENIX Security 22). USENIX Association, Boston, MA, 251–268. https://www.usenix.org/conference/usenixsecurity22/presentation/ shakevsky

  48. [48]

    Pritchard, Miranda Moss, and Daniel Gustafsson

    Eric Snodgrass, Helen V. Pritchard, Miranda Moss, and Daniel Gustafsson

  49. [49]

    InWorkshop on Computing within Limits (LIMITS) 2024

    Windternet: Designing grid-liberated servers for regenerative energy communities. InWorkshop on Computing within Limits (LIMITS) 2024. Virtual. https://urn.kb.se/resolve?urn=urn%3Anbn%3Ase%3Alnu%3Adiva-138472

  50. [50]

    stm32. 2025. TF-A overview - stm32mpu. https://wiki.st.com/stm32mpu/wiki/TF- A_overview

  51. [51]

    Martin Stojanov, Daniel Pargman, Mike Hazas, Rob Comber, and Jorge Luis Zapico. 2023. How do we arrive at constraints? Articulating limits for computing. InWorkshop on Computing within Limits (LIMITS) 2023. Virtual. https://doi.org/ 10.21428/bf6fb269.a317d18f

  52. [52]

    Sunxi. 2025. Pine64 - linux-sunxi.org. https://linux-sunxi.org/Pine64

  53. [53]

    Jennifer Switzer, View Profile, Gabriel Marcano, View Profile, Ryan Kastner, View Profile, Pat Pannuto, and View Profile. 2023. Junkyard Computing: Repurposing Discarded Smartphones to Minimize Carbon. InProceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2. 400–412. https:/...

  54. [54]

    Ubuntu Touch. 2026. Ubuntu Touch - Linux Phone. https://www.ubuntu-touch.io

  55. [55]

    U-Boot. 2026. Booting from TPL/SPL — Das U-Boot unknown version documen- tation. https://docs.u-boot.org/en/stable/usage/spl_boot.html

  56. [56]

    U-Boot. 2026. Building with GCC — Das U-Boot unknown version documentation. https://docs.u-boot.org/en/stable/build/gcc.html

  57. [57]

    Boxall, Ka Yu Cheng, Aleksandar N

    Jonovan Van Yken, Naomi J. Boxall, Ka Yu Cheng, Aleksandar N. Nikoloski, Navid R. Moheimani, and Anna H. Kaksonen. 2021. E-Waste Recycling and Resource Recovery: A Review on Technologies, Barriers and Enablers with a Focus on Oceania.Metals11, 8 (Aug. 2021), 1313. https://doi.org/10.3390/ met11081313 Number: 8

  58. [58]

    Jinwen Wang, Ao Li, Haoran Li, Chenyang Lu, and Ning Zhang. 2022. RT-TEE: Real-time System Availability for Cyber-physical Systems using ARM TrustZone. In2022 IEEE Symposium on Security and Privacy (SP). IEEE, San Francisco, CA, USA, 352–369. https://doi.org/10.1109/SP46214.2022.9833604

  59. [59]

    Shamar Ward and Mechelle Gittens. 2018. Building useful smart campus applica- tions using a retired cell phone repurposing model. In2018 Third International Conference on Electrical and Biomedical Engineering, Clean Energy and Green Computing (EBECEGC). 43–48. https://doi.org/10.1109/EBECEGC.2018.8357131