To be on the safe side, Bastian Könings "jail broke" his smartphone, modifying its operating system to get full control over the device. He says it was the only way to eliminate a gaping security hole in Google's Android mobile phone operating system that the IT security researcher and his team at the University of Ulm had uncovered .

The security hole makes the operating system vulnerable to attackers, allowing them to eavesdrop on all the data from the mobile phone's calendar, its contact lists or Android's primary photo program if the owner is using the phone in an area with an open WiFi network. Worse yet, it allows the attacker to directly view, modify or delete data in the apps, Könings said. All a person needs to access this data is a little experience with Google's third-party developer tools for Android.

It's not difficult, either, Könings said. "You don't even need a programming degree," he said. "It is all very well documented by Google. These attacks are very easy."

One possible scenario Könings has sketched out is one in which an attacker might create an open WLAN network and give it the kind of standard name a coffee shop chain or airport lounge might use, like "FreeWiFi." Any Android smartphone that comes within range of the hot spot and which had previously been registered on another network with the same name would automatically try to connect with the new, public free WiFi service -- without the user even noticing. As soon as the phone's calendar, contact and photo applications begin synchronizing with Google's web-based cloud services, the attacker would be able to access all the data transferred in apps that use its ClientLogin authentication protocol, the so-called tokens.

A Useful Tool for Competitors, Stalkers and Criminals

The tokens are "valid for a maximum duration of two weeks," Könings says. If an attacker is able to obtain one, then that person would be able to access data and make changes or add additional data to the victim's calendar, contact lists or private pictures. It is the kind of vulnerability that would be just as interesting for business rivals as for stalkers or criminals who have an interest in knowing when someone is not at home.

And it isn't just Google apps that use this sign-in system. Könings said that other apps, like the free e-mail program Thunderbird, can also be synchronized with the Google calendar using the same system. Other applications are also affected by the problem.

Theoretically, for example, an attacker could obtain account information for the image-editing software Picasa from a user by eavesdropping on the unencrypted data and then fill that account with incriminating images. Another feasible scenario would be for attackers to gather highly valuable information at an airport or at a restaurant frequented by business people or bankers including addresses, telephone numbers and other contact information for executives. Those details could then be used for personalized phishing attacks aimed at extracting private data from those individuals.

On Wednesday, Google addressed the problem, stating: "We are aware of the issue and we have already been able to fix the problem in the latest version of Android for the calendar and contacts and we are currently in the process of solving it for Picasa," the company stated. Könings said he contacted Google about the problem some time ago before it acted and that the company's answers had always been terse.

Security Problem Applies to 99 Percent of Android Users

Although Könings' team at the University of Ulm in southern Germany discovered the security breach, the preparatory work was done by researchers in the United States, who had shown that data from many applications was sent unencrypted over wireless networks as well as to other phones and devices. It also affects programs from third-party providers like Facebook and Twitter. A blog entry  by Dan Wallach, a professor at Rice University in Houston, put the researchers in Ulm on the trail to the discovery. Wallach had determined that some applications on Android smartphones transmit unencrypted data.

Almost all Android users are affected by the newly discovered security issue. According to the researchers, Google fixed the security problem in the latest version of Android, 2.3.4 -- but only for the Calendar and Contact applications. They said the problem still exists for users of the Picasa photo app, which is developed by a third party.

Android version 2.3.4 has only been available since early May and it sometimes takes months before mobile phone companies roll out the latest updates to their users. System updates are dependent on mobile providers and users can only make upgrades sooner if they jail break their phones, thereby violating the warranty.

At the Google I/O developers conference last week, the search-engine company announced its plans to improve and speed up the slow, uneven OS update process. Mobile phone manufacturers and service providers including Verizon, HTC, Samsung, Sprint, Sony Ericsson, LG, T-Mobile, Vodafone, Motorola and AT&T have all committed themselves to speeding up the pace of updates in the future. Upon hearing the news, developers in the conference hall cheered. As Könings pointed out, many had found "endless" waiting times on current operating system versions to be counterproductive, worrying and even dangerous.

"The only way to make my own device secure, was to acquire root access," Könings said. Through a self-implemented operating system update, he could then close the gap that his team had discovered. Nevertheless, the IT researcher said that non-expert Android users would be ill-advised to try to do that themselves, arguing that it would come with incalculable risks.

How to Fix the Problem

In early May, Google published information on the distribution of various operating system versions. The data was based on analysis of all devices called in by the software store Android Market within a two-week period. According to the results, nearly 80 percent of devices were operating on Android version 2.1 or 2.2. It's unclear how many users have installed the new Android version since then, but the percentage is thought to be minimal.