Much more than 99% of Android phones are potentially leaking data that, if stolen, could be employed to get the info they store on-line.
The information becoming leaked is normally used to get at internet-based services such as Google Calendar.
The discovery was produced by German security researchers searching at how Android phones deal with identification data.
Google has but to comment on the loophole uncovered by the team.
University of Ulm researchers Bastian Konings, Jens Nickels, and Florian Schaub made their discovery even though watching how Android phones handle login credentials for web-based services.
Numerous applications installed on Android phones interact with Google services by asking for an authentication token – basically a digital ID card for that app. As soon as issued the token removes the want to maintain logging in to a service for a given length of time.
Sometimes, the study says, these tokens are sent in plain text over wireless networks. This makes the tokens straightforward to spot so criminals eavesdropping on the wi-fi traffic would be able to locate and steal them, suggest the researchers.
Armed with the token, criminals would be able to pose as a certain user and get at their personal information.
Even worse, found the researchers, tokens are not bound to specific phones or time of use so they can be used to impersonate a handset almost anywhere.
“[T]he adversary can gain full access to the calendar, contacts information, or private web albums of the respective Google user,” the researchers wrote in a blog post explaining their findings .
Abuse of the loophole may possibly mean some men and women lose data but other changes may be harder to spot.
“…an adversary could alter the stored e-mail address of the victim’s boss or enterprise partners hoping to get sensitive or confidential material pertaining to their business,” the team speculated.
There is no suggestion that attackers are exploiting the Android loophole at the moment.
Practically all versions of the Android operating method had been passing round unencrypted authentication tokens, found the researchers. It was fixed in version 2.three.4 but, recommend Google figures , only .three% of Android phones are running this software program.
Some Google services, such as image sharing internet site Picasa, are still employing unencrypted authentication tokens that can be stolen, discovered the team.
They urged Android phone owners to update their device to prevent falling victim to attacks via the loophole. Google is also known to be working with operators and handset makers to get updates to folks faster than at present.
Click here to view rest of article from original web site