HTC to plug private data backdoor leak slurp vuln
Fix on the way for promiscuous Droid system app
Agentless Backup is Not a Myth
HTC has admitted some of its Android handsets have a flaw which could allow malicious apps to read customer locations and account details, but a fix is on the way.
The flaw was spotted last week and HTC were alerted to the flaw; now the mobe maker has admitted the problem exists and is working towards developing a fix that will be pushed out to handsets as soon as it's properly tested.
The vulnerability stems from HTC's decision to log user activity using an application which was, itself, unsecured. Applications that successfully asked for internet privileges could access the logging application and slurp details of user accounts and locations as well as various bits of system information.
The flaw was spotted by one Trevor Eckhart, who dropped HTC a line and gave the company five days to respond before taking the matter public, on the grounds of responsible disclosure, with a detailed breakdown of the vulnerability and some demonstration code.
HTC is keen to point out that they've no evidence of anyone exploiting the vulnerability, at least not yet, and that it is "working very diligently to quickly release a security update that will resolve the issue on affected devices". That patch will be sent out over the air once its been given the green light by testers, so HTC users should expect to see it soon.
Until then they might like to hold off installing applications which ask for internet privileges, though that is most of them these days. HTC reckons customers should avoid "installing and updating applications from untrusted sources", but given the security of Google's Marketplace relies entirely on peer reporting it might be better to hold off installing any unknown brands until the fix is in. ®
COMMENTS
the question is not how long for a fix (although tht's important), it's...
Why -and when - did HTC "decide" to log user activity? Surely that's a breach of privacy? On the other hand, if this is a package that provides user feedback, with the users express permission, why was it unsecured?
HTC Problems
I have had an HTC Thunderbolt since before the first OTA update came out. It is the worst phone I have ever had. Data connection drops, the entirety of Android crashing, terrible battery life, and the OTA that updated it to Gingerbread has broken it even more, causing Voicemail notifications to cease functioning. They have been "working" on these so-called fixes with "no official release date" and only saying "Thank you for your patience." And now this issue with privacy...?? This is the last HTC phone I buy.
great...
...except the carriers (Orange, Voda etc) all have custom roms and people don't even have the latest bug fixes that are already patched as it is. Don't hold your breath hoping for a fix unless you've got an unbranded handset.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
