.

Security Hole Could Affect 99% of Android Smartphones

<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Wed May 18, 2011 12:08 pm

Security Hole Could Affect 99% of Android Smartphones

Nice blog post by Graham Cluley of Sophos:


According to German researchers, 99% of Android devices might be at risk from a vulnerability which could allow unauthorised parties to snoop on your Google Calendar and Contacts information.

The discovery by the University of Ulm researchers brings to light a serious privacy issue, and underlines the difficulty that many Android smartphone owners appear to face keeping their operating systems up-to-date.

According to the paper by Bastian Könings, Jens Nickels, and Florian Schaub, entitled "Catching AuthTokens in the Wild: The Insecurity of Google's ClientLogin Protocol", in Android 2.3.3 and earlier the Calendar and Contacts apps transmit information "in the clear" via HTTP, and retrieve an authentication token (authToken) from Google.

That means that there's the potential for cybercriminals to eavesdrop on WiFi traffic and steal the authToken that your smartphone has just generated.



For full story:
http://nakedsecurity.sophos.com/2011/05 ... artphones/

Don
CISSP, MCSE, CSTA, Security+ SME
<<

sil

User avatar

Hero Member
Hero Member

Posts: 551

Joined: Thu Mar 20, 2008 8:01 am

Location: ::1

Post Wed May 18, 2011 12:42 pm

Re: Security Hole Could Affect 99% of Android Smartphones

There's a heck of a lot more holes to Android than that. Someone posted some vulnerabilities to a mailing list I am on.... http://www.privateerlabs.net/research
<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Thu May 19, 2011 9:06 am

Re: Security Hole Could Affect 99% of Android Smartphones

Google's official response regarding their server-side fix:

“Today we’re starting to roll out a fix which addresses a potential security flaw that could, under certain circumstances, allow a third party access to data available in calendar and contacts. This fix requires no action from users and will roll out globally over the next few days.”

Don
CISSP, MCSE, CSTA, Security+ SME
<<

millwalll

Post Thu May 19, 2011 1:21 pm

Re: Security Hole Could Affect 99% of Android Smartphones

Its good to see a company take such swift action to get the problem sorted.

Return to Mobile

Who is online

Users browsing this forum: No registered users and 0 guests

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software