Linux flaw affects about 1.4 billion Android devices

The newly discovered Linux flaw allows hackers to carry out attacks on Android users using a Man-in-the-Middle (MITM) Transport Layer Security  (TLS) Protocol Downgrade Attack. In layman's terms, a hacker could spy on you and your data. In more technical terms, a cybercrook can potentially degrade, or negotiate a lower version of TLS, between the client and server.

There are a few variants of this attack vector – in some older versions of Secure Socket Layer (SSL), it was possible to intercept handshake packets and modify the list of supported protocols. In other versions, attackers could intercept and drop packets, causing a browser to think that stronger versions of protocol were not supported.

This recent announcement follows the discovery of a related Linux kernel flaw that, when exploited, allows attackers to intercept unencrypted communication between at-risk machines, often injecting malware and shutting down communications. The very same Linux flaw can be found in Android version 4.4 KitKat and all following releases (yes, even the much-anticipated dev preview of Android Nougat!). When taking a look at Android’s platform versions chart, one can see that the number of devices affected by this vulnerability is nearly 80 percent, or a whopping 1.4 billion Android devices.

A virtual private network (VPN) can protect you from hackers

Most trusted and popular websites like Facebook or Gmail encrypt their traffic, making them immune to this specific vulnerability. However, other applications that use unencrypted traffic remain at risk for being spied on by exploited vulnerabilities.

By making use of a virtual private network (VPN) when browsing on unencrypted websites, users add a layer of encryption to their online activity. Thus, all their traffic would be encrypted and digi-scrambled, rendering it useless to hackers or other bad guys attempting to intercept their data or spy on them.

Although a VPN does wonders for your online protection, Android users affected by the Linux flaw aren’t completely out of the woods yet. To remove the flaw completely, it’s necessary for an upgrade or patch to be made available. At this time, there has yet to be a patch released. Keep your eyes peeled! For the time being, protect your online browsing using Avast SecureLine VPN.