Android devices could be leaking personal data

Android phones could be offering up usernames and passwords to hackers, allowing sensitive data to be siphoned off.

Researchers from the Institute of Media Informatics at Ulm University have discovered that Android devices could offer up user’s Google Calendar, Contacts and Picasa information.

The research found that devices using Android 2.3.3 and older using ClientLogin (which is used to authenticate apps from a remote destination) could potentially be hacked if using a non-secure connection, such as open Wi-Fi hotspot.

This means up to 99.7% of devices could be open to the exploit, which works by sending a request for an authentication token (authToken) from the Google service with a user name and password over a secure connection, and the received item is then valid for 14 days.

This means anyone with the correct equipment could sniff it out and use it on the same application to find your details, and even head in and modify all items from your Contacts, Calendar or Picasa.

Google has patched the problem in Android 2.3.4 for Contacts and Calendar, but not Picasa yet, according to the research. Android 3.0+ devices appear to be unaffected.


About SCB Enterprises
System Solutions and Integration

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: