Critical Android Vulnerability

[SandEagle]

Android Picasa in Android 3.0 and 2.x through 2.3 .4 uses a cleartext HTTP session when transmitting the authToken obtained from ClientLogin, which allows remote attackers to gain privileges and access private pictures and web albums by sniffing the token from connections with picasaweb. google.com.


http://www.us-cert.gov/cas/bulletins/SB11-192.html
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2344

 

[nixium]

I'm really wondering if android is going to end up as the windows of the mobile world at this rate. Huge market share, buggy because of implementation on multiple different devices, making it a super attractive target for hackers and the like. Especially if NFC payments become the norm.

 

[Dulanic]

I'm really wondering if android is going to end up as the windows of the mobile world at this rate. Huge market share, buggy because of implementation on multiple different devices, making it a super attractive target for hackers and the like. Especially if NFC payments become the norm.

Why because only Android can be exploited?

http://www.huffingtonpost.com/2011/07/06/iphone-security-issues-apple-ios-germany_n_891622.html
http://securityevaluators.com/content/case-studies/iphone/
http://www.readwriteweb.com/enterprise/2010/08/new-iphone-security-vulnerability.php

Both have exploits and both will be fixed.

 

[Binky]

I'm probably reading this wrong, but the "critical" fault can allow the dastardly hacker-villains to...view my napa valley trip photos? Oh No!

 

[vshah]

I'm probably reading this wrong, but the "critical" fault can allow the dastardly hacker-villains to...view my napa valley trip photos? Oh No!

delete them all, share your nekkid pix with the whole world, etc.

 

[BTRY B 529th FA BN]

i don't trust 99% of the apps on Android

 

[Dulanic]

i don't trust 99% of the apps on Android

Good for you?

 

[BTRY B 529th FA BN]

Good for you?

Yes, its good for me, thank you!

 

[Raduque]

delete them all, share your nekkid pix with the whole world, etc.

If you put naked pics on your phone and upload them to picasa, you deserve to have them stolen.