Feeds

HTC to plug private data backdoor leak slurp vuln

Fix on the way for promiscuous Droid system app

Remote control for virtualized desktops

HTC has admitted some of its Android handsets have a flaw which could allow malicious apps to read customer locations and account details, but a fix is on the way.

The flaw was spotted last week and HTC were alerted to the flaw; now the mobe maker has admitted the problem exists and is working towards developing a fix that will be pushed out to handsets as soon as it's properly tested.

The vulnerability stems from HTC's decision to log user activity using an application which was, itself, unsecured. Applications that successfully asked for internet privileges could access the logging application and slurp details of user accounts and locations as well as various bits of system information.

The flaw was spotted by one Trevor Eckhart, who dropped HTC a line and gave the company five days to respond before taking the matter public, on the grounds of responsible disclosure, with a detailed breakdown of the vulnerability and some demonstration code.

HTC is keen to point out that they've no evidence of anyone exploiting the vulnerability, at least not yet, and that it is "working very diligently to quickly release a security update that will resolve the issue on affected devices". That patch will be sent out over the air once its been given the green light by testers, so HTC users should expect to see it soon.

Until then they might like to hold off installing applications which ask for internet privileges, though that is most of them these days. HTC reckons customers should avoid "installing and updating applications from untrusted sources", but given the security of Google's Marketplace relies entirely on peer reporting it might be better to hold off installing any unknown brands until the fix is in. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Internet Security Threat Report 2014
An overview and analysis of the year in global threat activity: identify, analyze, and provide commentary on emerging trends in the dynamic threat landscape.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.