Google Issues Patch to Plug Android Data Leaks
The patch will roll out to Android phones starting Wednesday. "Today we're starting to roll out a fix which addresses a potential security flaw that could, under certain circumstances, allow a third party access to data available in calendar and contacts. This fix requires no action from users and will roll out globally over the next few days," Google said in a statement.
Researchers at Ulm University's Institute of Media Forensics reported the flaw last week. The issue lies in the way Android handles authentication tokens. If sent over an insecure http connection, a hacker on the same Wi-Fi network as the user could conceivably steal the authentication and gain access to the user's calendar, contacts and Picasa Web albums. Although the issue of contact and calendar leakage was already fixed in Android 2.3.4, the vast majority of Android phones run older versions of the software.
The odds of being attacked are unlikely, but it's not the type of issue Google would want to ignore. The patch only addresses calendar and contact data; Google is still trying to figure out how to address the issue within Picasa.
