Security Hole Could Affect 99% of Android Smartphones

This topic contains 3 replies, has 3 voices, and was last updated by  Anonymous 8 years, 5 months ago.

  • Author
    Posts
  • #6406
     Don Donzal 
    Keymaster

    Nice blog post by Graham Cluley of Sophos:

    According to German researchers, 99% of Android devices might be at risk from a vulnerability which could allow unauthorised parties to snoop on your Google Calendar and Contacts information.

    The discovery by the University of Ulm researchers brings to light a serious privacy issue, and underlines the difficulty that many Android smartphone owners appear to face keeping their operating systems up-to-date.

    According to the paper by Bastian Könings, Jens Nickels, and Florian Schaub, entitled “Catching AuthTokens in the Wild: The Insecurity of Google’s ClientLogin Protocol”, in Android 2.3.3 and earlier the Calendar and Contacts apps transmit information “in the clear” via HTTP, and retrieve an authentication token (authToken) from Google.

    That means that there’s the potential for cybercriminals to eavesdrop on WiFi traffic and steal the authToken that your smartphone has just generated.

    For full story:
    http://nakedsecurity.sophos.com/2011/05/17/security-hole-android-smartphones/

    Don

  • #39834
     sil 
    Participant

    There’s a heck of a lot more holes to Android than that. Someone posted some vulnerabilities to a mailing list I am on…. http://www.privateerlabs.net/research

  • #39835
     Don Donzal 
    Keymaster

    Google’s official response regarding their server-side fix:

    “Today we’re starting to roll out a fix which addresses a potential security flaw that could, under certain circumstances, allow a third party access to data available in calendar and contacts. This fix requires no action from users and will roll out globally over the next few days.”

    Don

  • #39836
     Anonymous 
    Participant

    Its good to see a company take such swift action to get the problem sorted.

You must be logged in to reply to this topic.

Copyright ©2019 Caendra, Inc.

Contact Us

Thoughts, suggestions, issues? Send us an email, and we'll get back to you.

Sending

Sign in with Caendra

Forgot password?Sign up

Forgot your details?