The general issue is that if your communication between your device and server is going over HTTP, then anybody can sniff it and modify it. This is pretty well

The general issue is that if your communication between your device and server is going over HTTP, then anybody can sniff it and modify it. This is pretty well known, and the 'solution' is to use SSL. Unfortunately with these open .google.com certificates in the wild, any android device that would have been securely connecting with SSL to a google server is now wide open to MITM as if it wasn't using SSL at all. I mentioned .google.com in particular since that's the certs floating in the wild, but obviously certs could be made for any site. *.google.com is also of particular issue as your Android device will hold a secure channel open for commands from Google Play. Anybody who can pretend to be Google Play can add/remove applications from your device as they wish, and Google Play itself runs with elevated privileges and can be used to keylog passwords, intercept credit cards, etc. This is bad stuff, man. At this very minute, someone may have installed a fake cert at your ISP, and your Android device may in fact be compromised without you having any idea. Obviously a completely different issue to hijacking traffic in a controlled environment!