The good news is that Google are already aware of the vulnerability and have moved to patch the bug in its latest Android 2.3.4 firmware update, although some of its services, including Picasa, are still transmitting sensitive data via unencrypted channels, according to the researchers.