1.4 Billion Android Users Exposed by a Linux Security Flaw

Security firm Lookout has uncovered a new bug in Linux, which puts as much as 1.4 billion users or 80-percent of all Android devices vulnerable. The TCP vulnerability allows the hackers to affect connection or install malware on your phone if the website is infected, after which they can spy on you.

The bug was first found on Linux 3.6 back in 2012, and found its way to Android through version 4.4 KitKat. It has since been present and affects all versions released after that. The flaw is said to be of medium severity and while the Linux flaw appears to be patched, no fix has been released for Android yet.

Before launching an attack, the attacker first needs to establish whether the communication device is linked to an unprotected connection, after a malicious code can be added to the traffic. The attack is near-perfect for targeted attacks especially if the attacker knows what websites the victim visits.

Enterprise users should be particularly vary of this threat as a bunch of potentially weak links are out in the open.

“If you’re running an enterprise mobility program, a number of Android devices are potentially vulnerable to a serious spying attack.”

It is not impossible to keep yourself protected, though, as long as your phone is supported by VPN and the websites you visit are encrypted.

“The tl;dr is for Android users to ensure they are encrypting their communications by using VPNs, [or] ensuring the sites they go to are encrypted.”

The flaw will likely be fixed in the upcoming Android 7.0 Nougat, but until then the least you can do is make sure your connection is secure.