If I use my mobile device in a Wifi hotspot, can I take it that it bears the same risks as using a laptop in that data can be easily sniffed and that the mobile device is also open to man-in-the-middle attacks?
Yes, you are subject to the same risks as you would have in a laptop (or any device that connects to a wireless network, for that matter); to avoid them, the standard security procedures apply: do not use unencrypted connections that you do not trust and always prefer HTTPS for browsing.
Yes. There are 2 different problems:
A. An attacker sniffing and/or redirecting all traffic via arp-spoofing.
Two different android applications already do this (banned from market of course). Please note that it might be illegal to install and test them in your country!
- FaceNiff allows (don't know if it still applies) to snoop on logged in credentials and take over facebook accounts and similar.
- Droidsheep does effectively the same
B. An attacker impersonating as the Hotspot.
The more serious one, I suppose. It allows to hijack your phone any time if you previously have connected to a well known hot-spot provider.
Your android phone usually remembers known hotspots by the accesspoints ESSID alone (it's name) and tries to reconnect to it any time it sees such an ESSID again for ease of use. This allows an attacker to set up such a well known ESSID and your phone will happily connect to it then. Because no arp-spoofing will be involved, you cannot detect this behaviour easily.
Just try it yourself, set up your phone as an unencrypted hotspot device using a well known hotspot ESSID and see how many connections you get in no time... It's maybe not even illegal to use such an ESSID and noone is tricked into using your connection either.