According to German researchers, 99% of Android devices might be at risk from a vulnerability which could allow unauthorised parties to snoop on your Google Calendar and Contacts information.
The discovery by the University of Ulm researchers brings to light a serious privacy issue, and underlines the difficulty that many Android smartphone owners appear to face keeping their operating systems up-to-date.
According to the paper by Bastian Könings, Jens Nickels, and Florian Schaub, entitled “Catching AuthTokens in the Wild: The Insecurity of Google’s ClientLogin Protocol”, in Android 2.3.3 and earlier the Calendar and Contacts apps transmit information “in the clear” via HTTP, and retrieve an authentication token (authToken) from Google.
That means that there’s the potential for cybercriminals to eavesdrop on WiFi traffic and steal the authToken that your smartphone has just generated.
Google’s official response regarding their server-side fix:
“Today we’re starting to roll out a fix which addresses a potential security flaw that could, under certain circumstances, allow a third party access to data available in calendar and contacts. This fix requires no action from users and will roll out globally over the next few days.”