– May possibly 17, 2011Posted in: Uncategorized
Rice University professor Dan Wallach wrote a blog post in February that discussed the threat that network eavesdropping poses to Android users. Numerous applications, such as the platform’s native Google Calendar software, do not use SSL encryption to safeguard their network visitors. Wallach speculated that the calendar software could be susceptible to an impersonation attack.
Researchers at the University of Ulm followed up on Wallach’s findings and devised a proof-of-concept attack to demonstrate the vulnerability. A number of of Google’s applications use the ClientLogin authentication program but fail to use SSL to encrypt their communication with Google’s servers, creating them susceptible to eavesdropping attacks.
ClientLogin is developed to allow applications to trade a user’s credentials for an authentication token that identifies the user to the service. If the token is passed to the
Article source: http://arstechnica.com/gadgets/news/2011/05/android-vulnerability-reflects-require-for-much more-timely-updates.ars