A “critical flaw” has been detected in the virtual private network offered by Android operating systems in the Indian cyberspace leading to “hijack” of personal data of users.
Internet security sleuths have alerted consumers of this web-based service to guard against the spread of this virus which affects computer systems and mobile phones using the Android system.
The suspicious activity has been noticed in two Android versions — 4.3 known as ‘Jelly Bean’ and the latest version 4.4 called ‘Kit Kat’.
- Samajwadi Party Crisis Deepens: Here’s How It Will Impact UP Polls
- 24 Maoists Killed In Encounter In Odisha
- Varun Gandhi Under Attack Over Defence Deals: Here’s How
- This Diwali, Let Blind Students Brighten Up your Homes With Candles & Diyas
- CBI Files Supplementary Chargesheet In Sheena Bora Murder Case
- Soha Ali Khan And Vir Das Starrer 31st October Audience Reaction
- Sahara Chief Subrata Roy’s Parole Extended Till November 28
- Simple Tips To Secure Your Debit Card From Fraudsters
- New Zealand & India Team Being Welcomed In Chandigarh
- Mumbai Call Centre Scam: All You Need To Know
- Jammu Kashmir Chief Minister Mehbooba Mufti Appeals To Police: Here’s What She Said
- Shocker From Ahmedabad: Find Out What Happened
- Bigg Boss 10 Day 3 Review: Celebs Fail To Do Well in First Task
- Airtel Offers 10GB Data At Rs 259 For New 4G Smartphone Users
- Aamir Khan Starrer Dangal’s Trailer Launched: First Impressions
“A critical flaw has been reported in Android’s (virtual private network) VPN implementation, affecting Android version 4.3 and 4.4 which could allow an attacker to bypass active VPN configuration to redirect secure VPN communications to a third party server or disclose or hijack unencrypted communications,” the Computer Emergency Response Team of India (CERT-In) said in a latest advisory to users of this network.
The CERT-In is the nodal agency to combat hacking, phishing and to fortify security-related defences of the Indian Internet domain.
VPN technology is used to create an encrypted tunnel into a private network over public Internet. Organisations and group of people use such connections to enable employees or acquaintances to securely connect to enterprise networks from remote locations through multiple kinds of devices like laptops, desktops, mobiles and tablets.
The agency said the current malicious application is capable of diverting the VPN traffic “to a different network address” and successful exploitation of this issue “could allow attackers to capture entire communication originating from affected device.”
The lethality of the virus to disrupt a system is large.
“It is noted that not all applications are encrypting their network communication. Still there is a possibility that attacker could possibly capture sensitive information from the affected device in plain text like email addresses, IMEI number, SMSes, installed applications,” the advisory said.
Cyber experts said that this anomaly could only lead to capture and viewing the data which is in plain text and Android applications directly connecting to the server using SSL will not be affected.
Websites which use ‘https’ in their URL will also be safe.
The cyber agency has also suggested some countermeasures to beat this threat.
“Apply appropriate updates from original equipment manufacturer, do not download and install application from untrusted sources, maintain updated mobile security solution or mobile anti-virus solutions on the device, exercise caution while visiting trusted or untrusted URLs and do not click on the URLs received via SMS or email unexpectedly from trusted or received from untrusted users” are some of the combat techniques which have been suggested by the agency.