> Fans of the fledgling cryptocurrency known as Bitcoin got quite a shock in recent days as some clever thieves worked out yet another method to swipe virtual cash from unsuspecting users. The source of the theft was traced to a bug in Android, and now Google has acknowledged the flaw exists.
Another day, another Android flaw.
> A feature that allows Android users to authenticate themselves on Google websites without having to enter their account password can be abused by rogue apps to give attackers access to Google accounts, a security researcher showed Saturday at the Defcon security conference in Las Vegas.
And with that information, the attacker has access to “Google Apps, Gmail, Drive, Calendar, Voice and other Google services.”
Security researcher Ibrahim Balic said he meant no harm and reported the security hole to Apple. Nick Arnott also has a [good story about this](http://www.imore.com/security-researcher-claims-have-reported-security-bugs-shortly-apples-developer-portal-outage) on iMore.
> We have just released a very important security update for our iPhone and iPad apps addressing an issue that allowed passwords to be compromised in certain circumstances¹. Please download the update now.
> If you’ve been using these apps, you should also update your password on Tumblr and anywhere else you may have been using the same password.
That doesn’t sound good.
Nick Arnott give us a walkthrough of how the exploit worked. It’s important to note that Apple has already fixed the security hole, but it’s interesting to see what happened.