Android easy to hack
By Pulkit Sharma

Following up on revelations that Android smarphones are vulnerable to hacking in open WiFi networks, a Germany University has revealed that attackers can get through to most Google Services using the ClientLogin authentication protocol for access to data APIs.  All Android phones below 2.3.3 have this security flaw

“
ClientLogin is meant to be used for authentication by installed applications and Android apps. Basically, to use ClientLogin, an application needs to request an authentication token (authToken) from the Google service by passing an account name and password via a https connection. The returned authToken can be used for any subsequent request to the service API and is valid for a maximum duration of 2 weeks. However, if this authToken is used in requests send over unencrypted http, an adversary can easily sniff the authToken. Because the authToken is not bound to any session or device specific information the adversary can subsequently use the captured authToken to access any personal data which is made available through the service API. For instance, the adversary can gain full access to the calendar, contacts information, or private web albums of the respective Google user. This means that the adversary can view, modify or delete any contacts, calendar events, or private pictures. This is not limited to items currently being synced but affects all items of that user.

….
“