About 1.4 billion Android users are at risk of having their web traffic hijacked, according to recent security bug revealed in the TCP implementation. All the Android devices that run Linux Kernel 3.6 from 2012 or Android 4.4 KitKat are vulnerable to such an increasing threat, which is discomforting.
Of course, many would have guessed the association between Android and Linux (since Androids are based on the Linux kernel). Google is well aware of this vulnerability. But, the percentage of Android users affected by the threat is intimidating as it is – although Google does not regard the risk as high. A patch will be available (thankfully) within next month’s Google update.
Even if there is a patch on the way against the vulnerability, a great line of defence for Android users is to encrypt their Android devices. The researchers from Lookout are warning Android users of the risks that derive from not encrypting their device.
Hijacking Unencrypted Web Traffic
Among the safety precautions suggested by Lookout, here is what Andrew Blaich has to say: “This means ensuring the websites you browse to and the apps you use are employing HTTPS with TLS. You can also use a VPN if you want to add an extra step of precaution,” and continues: “If you’re running an enterprise mobility program, many Android devices are potentially vulnerable to a serious spying attack. CISOs should be aware that this new vulnerability affects their Linux environments, Linux-based server connections (e.g., to popular websites), in addition to Android devices,”
No man in the middle attack is required, for the vulnerability to take place. Traffic can be intercepted without it and hijackers will be euphoric to see that an exploit so big is possible to happen in a jiffy. It is of medium severity (CVE-2016-5696), and it mainly focuses on particular targets and not randomly.
Corporate users have got more at stake, apparently. All files can be compromised, including the top classified documents and corporate emails, etc. So, enterprises need to take immediate action against the vulnerability for fear of the worst.
As we have mentioned above, encryption is the best way for you to stay off the hook and remain thoroughly protected on Android OS. It’s recommended to find out more about how to encrypt your Android device here. If you are better prepared, there is nothing keeping you down – not even latest vulnerabilities!
[Source: Value Walk]
