A few days before the government agency CERT-IN that monitors cyber-threat issued an advisory informing that Android 4.3 and 4.4-based smartphones are vulnerable to hackers. By using a known flaw in the phones the hackers can steal information. The flaw lies in the way the latest versions of Android implement virtual private network (VPN), a technology mostly used by enterprises.
By utilizing the flaw hackers and others can read and capture information exchanged between smartphones running on 4.3 or 4.4 and a VPN server. As per Google report released on February 4, 8.9 per cent of all Android-based phones are running on 4.3 version whereas 1.8 per cent on 4.4.
It is a risk for the companies that implement VPN and allow employees to use Android phones. Google is aware of the flaw and is likely to fix it in the next version of Android.
VPN is used to establish secure connection between a company servers and devices like smartphones and laptops that their employees may use during work. A VPN network offers end-to-end encryption and makes it almost impossible for anyone to snoop onto the communication taking place between a phone/laptop and a web server.
CERT IN added that hackers may also collect information on text messages, emails and contacts stored on the device. The agency has suggested that Android users should apply OS updates when they are available, should not install applications from untrusted sources and should not click on unidentified web links received in messages or emails.
