Feeds

HTC Android handsets spew private data to ANY app

Mystery data logger opens backdoor for slurping

Protecting against web application threats using SSL

A data logger pushed out by HTC to Android handsets has opened up a vulnerability allowing any app with internet permissions to access private customer information.

The vulnerability was spotted by Trevor Eckhart, who informed HTC about it and waited five days for a response. Following that he decided to go public and gave Android Police the details along with demonstration code and a video showing how an application that is supposed to see almost nothing can now see almost everything.

So an application that is supposed to be restricted to accessing the internet - a common ability requested by freebie apps to collect advertisements - can also access the user's location and details of all their synchronised accounts, not to mention the list of running tasks, the state of Wi-Fi connections, and system logs.

The data is being collected by a system package called HtcLoggers.apk, installed by HTC onto a range of Android handsets for reasons that aren't clear. That logging package accumulates data all the time, but it also has an accessible interface that other applications can use to request specific information - it even has a "help" command for those who don't know what it is they want to know.

The information provided includes a load of system information as well as the account and location data, which is probably most sensitive, and the internet privileges requested also mean the application can send the data off to parts unknown, which is nice.

Eckhart has produced a demonstration app, and is asking those with HTC handsets to take a look and help establish how widespread HtcLoggers.apk is.

When looking closely at what HTC had installed he also stumbled across the scarily named androidvncserver.apk (VNC being a remote-control protocol), but hasn't found any way to activate it as yet so this could be a red herring.

We don't know because HTC isn't saying. The company gave us a statement saying it is aware of the accusations and is looking into them, and that it is "taking customers' security seriously". But HTC received notification a week ago, and didn't respond to that information until it was made public.

The breach is a serious one, particularly given that free apps so often ask for internet privileges to collect embedded adverts. Such an app could now harvest data for spear phishing or similar, and given the publicly available demonstration code it would be naive to think someone isn't working on that right now.

So if you've an HTC Android handset then it's probably worth laying off the free downloads, at least until HTC has something more useful to tell us. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.