According to German researchers, 99% of Android devices might be at risk from a vulnerability which could allow unauthorised parties to snoop on your Google Calendar and Contacts information.
The discovery by the University of Ulm researchers brings to light a serious privacy issue, and underlines the difficulty that many Android smartphone owners appear to face keeping their operating systems up-to-date.
According to the paper by Bastian Könings, Jens Nickels, and Florian Schaub, entitled “Catching AuthTokens in the Wild: The Insecurity of Google’s ClientLogin Protocol”, in Android 2.3.3 and earlier the Calendar and Contacts apps transmit information “in the clear” via HTTP, and retrieve an authentication token (authToken) from Google.
That means that there’s the potential for cybercriminals to eavesdrop on WiFi traffic and steal the authToken that your smartphone has just generated.
As authTokens can be used for several days for subsequent requests, hackers can exploit them to access what should be private services and data – such as your web-based calendar. Furthermore, it turns out that the generated authTokens are not linked to a particular phone, so they can be easily used to impersonate a handset.
Yuck!
The scenario is a real problem if you use an unencrypted WiFi hotspot (such as those commonly available in hotel lobbies, airports or at the coffee shop on the corner of your street), as someone could snoop on your authToken and abuse it.
According to the researchers, Google has fixed the problem in Android 2.3.4. But there’s the rub. Just how many people are still running older versions of the Android OS?
Approximately 99% of Android users are vulnerable, as they haven’t updated to at least version 2.3.4 (codenamed “Gingerbread”).
Unfortunately it’s not always possible to easily upgrade the version of Android running on your phone as you are very dependent on your mobile phone manufacturer and carrier providing the update to you over the air.
There is a huge range of Android smartphones out there, and whereas Apple can issue a single iOS update to patch iPhones and iPads, things aren’t so simple for Google’s users. This fragmentation inevitably leaves Android devices open to security problems.
Fortunately, Google seems to be aware of this pain, and says it will work more closely with manufacturers and carriers to ensure users can receive the latest Android updates in the future.
But what should you do if you’re a concerned Android owner?
My recommendation would be to upgrade to the latest version of Android if at all possible.
Furthermore, do not use open WiFi networks as your communications may not be properly protected. If you’re worried about this latest security issue you might be wise to connect to the internet via 3G from their smartphone rather than using unencrypted public WiFi connections.
Using 3G may eat into your data plan, but it’s far less likely that your communications are being snooped upon.
Update: Good news. Google has started rolling-out a fix for this vulnerability.
