Data Leak Vulnerability Haunts Latest Android (Gingerbread)
A computer security researcher at NC State University,Xuxian江, has identified a security vulnerability in the latest version of Google Android, version 2.3, also known as Gingerbread. The vulnerability gives attackers access to user data – similar to a vulnerability identified in previous iterations of Android, which Google thought it had fixed with the latest version.
Basically, simply by clicking on a link, Android users may give attackers access to personal information. If exploited, the vulnerability would allow a malicious Web site to read and upload the contents of any file stored on the phone’s microSD (memory) card. Information on the SD card could include saved voicemails, photos or online banking data.
The vulnerability would also allow attackers to find out all of the applications installed on a phone, and upload many of the applications onto a remote server – including all built-in applications.
Jiang, who discovered the vulnerability when working on an Android-related research project, has confirmed the vulnerability using Gingerbread being run on a Nexus S phone.
Asimilar vulnerabilitywas reported on earlier versions of Android phones, leading Google to make changes in Gingerbread designed to address the flaw. However, Jiang has found that the Gingerbread fix can be bypassed.
So,what can be done to mitigatethe vulnerability? The simplest way to protect your information is to remove or disable the SD card in your phone. However, that will leave you unable to save voice mail or photos. You could also disable the JavaScript function in your browser. But that would affect your ability to access online content. Another option is to switch to a third-party browser, such as Firefox.
Now that this information is out there, programmers can begin to develop means of addressing the vulnerability.
- Categories:
I am wondering will the new ice cream sandwich have a similar data leak problems? I am wondering because I am about to upgrade my android phone.
Security issues with all models of mobile phones is going to become a major concern as the number of users increases. It reminds me of the early days of the Internet when it really was the Wild West .What are the developers doing to improve security issues?
Very insightful post, Android is really going to have to do something about the holes in the os. Let’s hope in 2011 they can patch these issues up.
It seems Microsoft has just found security vulnerabilities in Chrome as well, hopefully this isn’t going to be a trend for Google
Very insightful post, Android is really going to have to do something about the holes in the os. Let’s hope in 2011 they can patch these issues up.