Google is working to patch a new data-stealing vulnerability that affects all versions of the Android operating system.
The vulnerability was discovered by security researcher Thomas Cannon. "While doing an application security assessment one evening I found a general vulnerability in Android which allows a malicious website to get the contents of any file stored on the SD card," he said on his blog. "It would also be possible to retrieve a limited range of other data and files stored on the phone using this vulnerability." In other words, a successful exploit wouldn't provide the attacker with root access to all device data.
Cannon said that after he emailed Google about the bug, the company made contact to discuss the issue just 20 minutes later. Google also asked him to withhold some details while it works on a fix. "As my intention is to inform people about the risk, not about how to exploit users, I've agreed," he said.
Google said it will patch the issue as part of its forthcoming Gingerbread (2.3) maintenance release of Android.
But Chester Wisniewski, senior security advisor at Sophos Canada, warned about older devices that, because of memory limitations, can't run the latest version of Android, such as the HTC Dream (G1) or Motorola Devour. Accordingly, they could be "vulnerable in perpetuity" to the attack, while even the latest devices will be vulnerable for at least the next couple of weeks.
As a workaround, he said, don't use the built-in Android browser. "For now the only option is to choose third-party applications that are updated through the Android Market instead of using the embedded applications." In particular, he recommended Opera Mobile or Firefox 4 portable (currently in beta).