toggle

AAPL Stock: 109.27 ( -1.1 )

Printed from http://www.macnn.com

HTC Android phones allegedly face gaping privacy exploit

updated 12:50 pm EDT, Sun October 2, 2011

HTC may slip personal, device data in major bug

An investigation may have revealed a major security exploit in HTC's Android phones. The look, by Android Police and custom firmware maker Trevor Eckhart, alleges that HTC's most recent custom Sense UI interface has logging tools such as HTCLogger that insecurely collect private data. Any app that requires basic Internet permission can technically have access to account information, phone numbers, text messages, and even precise device information such as processor and memory details, installed apps, and location.

The logging tools themselves have their own extensive command systems, but no login checks. They use root-level privileges to try and send out certain kinds of features, the researchers checked. HTC even has a VNC client in its installs that could theoretically be used to remotely access the phone itself if the device was compromised.

Phones known to include the code in question are headlining phones such as the Evo 3D, Evo 4G, and Thunderbolt. Other phones, such as the myTouch 4G Slide, the Sensation, and even future phones like the Vigor, might also be susceptible.

HTC was reportedly contacted about the flaw more than a week ago to privately disclose the problems before an attempt but hasn't responded so far. It may be investigating the issue but hasn't confirmed this.

While it remains possible that the actual susceptibility of the logs to the attack is being overstated, the discovery if substantiated could leave a large portion of Android itself open to privacy violations. Google itself tends to require consent before information leaves a device, but its willingness to let third parties customize the underlying code lets its hardware partners potentially create security exploits and privacy concerns that didn't exist before. Apple doesn't offer freedom to customize the code on iOS but, as it controls the whole process, also can't be undermined by a third party.






by MacNN Staff

POST TOOLS:

TAGS :

toggle

Comments

  1. slapppy

    Joined: Dec 1969

    +3

    Wow

    That sucks for Android users. lol

  1. Geoduck

    Joined: Dec 1969

    -4

    Sounds familiar

    "HTC's most recent custom Sense UI interface has logging tools such as HTCLogger that insecurely collect private data. Any app that requires basic Internet permission can technically have access to account information, phone numbers, text messages, and even precise device information such as processor and memory details, installed apps, and location."

    Wasn't that same thing Apple got crucified for last year. As it's not Apple this bug will be quietly fixed and nobody will have a fit or file suit.

  1. msuper69

    Joined: Dec 1969

    +5

    No thanks!

    Android is way too open. Anybody can write malicious code and nobody vets the code before users download and install. I'll take Apple's approach.

  1. UmarOMC

    Joined: Dec 1969

    0

    This is HORRIBLE

    Can't say much else...

  1. SockRolid

    Joined: Dec 1969

    +1

    Yay open!

    This is what happens when you let hardware manufacturers diddle with an OS.

    And exactly how much is HTC paying Microsoft to license the patents that Android infringes? Might be more cost effective to just license a professionally developed mobile OS instead. LIke oh, I dunno, maybe Windows Phone 7?

  1. testudo

    Joined: Dec 1969

    -1

    and...

    any iPhone app has complete access to your address book without prompting and send it out. Oh, but that's a design 'feature', so it's OK.

Login Here

Not a member of the MacNN forums? Register now for free.

toggle

Network Headlines

Follow us on Facebook

toggle

Most Popular

Advertisement

Recent Reviews

Blue Yeti Studio

Despite being very familiar with Blue Microphones' lower-end products -- we've long recommended the company's Snowball line of mics ...

ZTE Spro 2 Smart Projector

Home theaters are becoming more and more accessible these days, but maybe you've been a bit wary about buying a home projector. And h ...

MSI Geforce GTX 970 100ME

When Nvidia announced a new line of video cards in September 2014, many people thought things would continue to be business as usual i ...

toggle

Most Commented