Massive Android data leak - how worried do we need to be?

kutsu119

Be avidly reading about this massive android mobile data leak - front page of the Metro, BBC, Sky News etc. It sounds as bad, if not worse, than the one that Apple were rightly chastised for (the data tracking thing).

As someone considering buying an Android mobile when my current contract expires, and the apparent difficulty of patching the phones due to how many different versions exist - how worried do we, the consumer, need to be?

steve1980

As long as you have the latest version 4.2.3 I think, you're fine.

23n1th

It would appear that all you need to do to counteract this is to switch off the auto-sync (which I do to save battery power) and use secure networks when updating or syncing your apps.

kutsu119

It's pretty poor on Google's part though - especially as so many people took the moral high-ground after the Apple fiasco..

paddyrg

I just use HSDPA/3G everywhere for everything, no worry about open networks that way. Yes, it is a security vulnerability and a severe one, but only in certain circumstances (promiscuous network activity is always going to be a risk though with any device)

Fifer

I accept there may be a vulnerability using an open wifi network, but with a properly secured home wifi network or 3G/mobile, is there really much of a vulnerability?

PS I think there's a typo in Steve's post above. The version of Android with the fix is 2.3.4

gaming_guy

...........

teffers

Using 2.3.4 so I'm not worried at all :cool:

paddyrg

Fix going in now... http://www.theregister.co.uk/2011/05/18/google_android_security_fix/

From what I understand...

Attackers monitoring Wi-Fi hotspots and other open networks could exploit the weakness by copying the so-called authTokens and using them to gain unauthorized access to users' Google Calendars and Contacts.

The fix forces Google servers to use an encrypted https connection when phones sync with Calendar and Contacts

mr_fishbulb

kutsu119 wrote: »

Be avidly reading about this massive android mobile data leak

Forgive me if I'm wrong, but there hasn't been a leak.

This news is of a vulnerability in the way that Android devices authenticate themselves when synchronising. The authentication is done by a token ID (basically a piece of text) which is sent unencrypted and are not one-time authenticators. This is vulnerable to a replay attack where anyone who gets a copy of your token ID can impersonate with it.

Basically a very similar to the vulnerability FireSheep highlighted to the masses where the of sending authentication cookies over http (unencrypted rather than https (encrypted) meant they could be captured and replayed.

23n1th

I also can't see how this can be worse than apples recent "software bug" which was collecting lots of private data from users.