• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Root Very happy im rooted and on 2.3.4 for this reason

They're only mentioning over wifi, not over Network provider data services.

If thats true, I feel pretty safe. My network is pretty resiliant. My network has been tested against brute force and other attacks and faired very well.
 
Also, to any mods / guides who may view, please can I recommend this is NOT moved into the root forum? Its very important information (data privacy issues)
 
well whos to say hsdpa is encrypted and if you are on the same subnet/internal iprange as other android devices im pretty sure you could packet sniff from android ips
 
SUroot said:
They're only mentioning over wifi, not over Network provider data services.

If thats true, I feel pretty safe. My network is pretty resiliant. My network has been tested against brute force and other attacks and faired very well.
Click to expand...

How do you know your network is resilient to attacks?
 
williamj1 said:
How do you know your network is resilient to attacks?
Click to expand...

I was drunk round at my hacking mates house and we brute force attacked my public ip address. Ran all his scripts against it and couldn't get in. Not even on known open Ports
 
SUroot said:
I was drunk round at my hacking mates house and we brute force attacked my public ip address. Ran all his scripts against it and couldn't get in. Not even on known open Ports
Click to expand...

Are we talking about phone networks? You couldn't hack O2?

This stuff is way over my head, but that takes guts :P
 
SUroot said:
They're only mentioning over wifi, not over Network provider data services.

If thats true, I feel pretty safe. My network is pretty resiliant. My network has been tested against brute force and other attacks and faired very well.
Click to expand...

Apologies, I took network provider data services to mean O2 etc?
 
Yes that's what it means. But the first line is WiFi which is what I'm talking about.

The article says about stuff being intercepted over WiFi, but my WiFi is good
 
SUroot said:
Yes that's what it means. But the first line is WiFi which is what I'm talking about.

The article says about stuff being intercepted over WiFi, but my WiFi is good
Click to expand...

You have me worried now.

Mine isn't... simple bt hub with standard WPA2 or whatever it's called encryption. Need I do more?
 
I recommend not broadcasting your ssid.

From a wired perspective, there's plenty of apps you can run on an old desktop machine to make it an additional hardware firewall.

I just use a simple linksys router hidden ssid. Works well

Can't speak about home hubs though. Never had or tested one
 
kinda Eddy but still, its interesting as most apns on the various networks are nat'd
who knows what ports and restrictions are open or closed
facts are this, that stuff is broadcast in plain txt be it wifi or over a data network
an app could sniff it, a clever idiot with a device posing as a mobile phone on the same data network subnet could probably see it too.

the article says wifi only but the protocol these apps are using is still delivering information in plain txt form

i actually think its a bigger issue than we think and one that google has kept under wraps as they have patched
 
I went and flashed Oxygen as soon as I heard about this, pity because Froyo was my choice for my everyday phone, but Oxygen seems to hold up.
 
SUroot said:
They're only mentioning over wifi, not over Network provider data services.

If thats true, I feel pretty safe. My network is pretty resiliant. My network has been tested against brute force and other attacks and faired very well.
Click to expand...
Even then, wouldn't it be a concern when connecting to open public networks like at Starbucks, library or airport? I frequently connect to those when I'm on the go.
 
thing i dont get is they mention "only over wifi" but then the applications/web themselves send the tokens in plain text.
I cant see why the apps/websites would send information encrypted over datanetwork but suddenly change its security model over wifi. it makes no sense

im not trying to scaremonger but i think they only mention wifi cos its easier to sniff
it detracts away from the fact that you can be on the same subnet and iprange as other smartphones in the data network therefore some clever sod might be able to packet scan the open ports for data which has been sent from un patched android devices with another device on the network.
even better use a linux box with a datacard/tethered device on the network
 
I think you're right. It wont change policy over a different protocol.

What we could do with is a list of apps that transmit in plain text.
 
SUroot said:
I think you're right. It wont change policy over a different protocol.

What we could do with is a list of apps that transmit in plain text.
Click to expand...
indeed, there must be something google put in 2.3.4 that encrypts all tokens regardless of site api requests
 
Rastaman-FB said:
kinda Eddy but still, its interesting as most apns on the various networks are nat'd
who knows what ports and restrictions are open or closed
facts are this, that stuff is broadcast in plain txt be it wifi or over a data network
an app could sniff it, a clever idiot with a device posing as a mobile phone on the same data network subnet could probably see it too.

the article says wifi only but the protocol these apps are using is still delivering information in plain txt form

i actually think its a bigger issue than we think and one that google has kept under wraps as they have patched
Click to expand...

Never have and never will use a VPN, I only connect to trusted/secured networks and, tbh, don't have a lot of personal data linked to my Gmail account. If they want my parents phone number then bully for them!

I won't be worrying about this one iota
 
EddyOS said:
Never have and never will use a VPN, I only connect to trusted/secured networks and, tbh, don't have a lot of personal data linked to my Gmail account. If they want my parents phone number then bully for them!

I won't be worrying about this one iota
Click to expand...
who said anything about vpn? vpn is generally an rsa encrypted channel.

im talking standard gprs/3g/hsdpa

each device on the data carrier is connected from a dhcp pool from a sgsn/ggsn and given an ip from a range within that subnet
certain ports have to be open for data transit to work
potentially (i have no actual factual information so cannot fully confirm) someone within that same subnet/iprange can connect a device to the network and find plain text being transmitted from these ports.

imo if you use your providers data network you have just as much reason to be concerned as someone using adhock/unsecured wifi nodes
 
VPN is about as safe as you can get.

But if you're on a home wifi and someone is sat outside in a van, that wont help as its between your phone and your router where they intecept.
 
Actually the linked blog says its over open wifi networks:

Catching authTokens in the wild-Universitt Ulm

Fixing the issue

What app developers can do:

  • Android apps and synchronization services using ClientLogin should immediately switch to https. In the newest Android release (2.3.4) this step was already taken for the Google Calendar and Contacts apps, but other apps need to follow. The Gallery app is developed by Cooliris who probably were not made aware of the issue. However, the Android security team told us that they are investigating the Gallery app as well. So hopefully a fix should be integrated in the next release.
  • Google APIs offer more secure authentication services. Switching to oAuth for authentication would mitigate the authToken capture issue. Https should be used in addition to prevent synced data to be transmitted in the clear.
What Google/Android can do:

  • The lifetime of an authToken should be drastically limited.
  • Google services could reject ClientLogin based requests from insecure http connections to enforce use of https. Https is already required for the Google Docs API und will be required for Google Spreadsheet and Google Sites APIs in September 2011. It should be mandatory for all of Google's data APIs.
  • Automatically connecting to known Wifi-networks could be limited to protected networks. At least a respective option should be provided to users.
What Android users can do:

  • Update to Android 2.3.4. Update your phone to the current Android version as soon as possible. However, depending on your phone vendor you may have to wait weeks/months before an update is available for your phone. Hopefully this will change in the future.
  • Switch off automatic synchronization in the settings menu when connecting with open Wifi networks.
  • Let your device forget an open network you previously connected to, to prevent automatic reconnection (long press network name and select forget)
  • The best protection at the moment is to avoid open Wifi networks at all when using affected apps.
Click to expand...
 
At the end of the DAY Google/manufacturers need to sort there @ss's out over these updates - like, how long are these taking...all that seems to be happening is MORE phones being released....ad infinitum...................!
 
You must log in or register to reply here.
Back
Top Bottom