Some HTC Android phones found vulnerable to WiFi password leak

Feb 02, 2012 by Bob Yirka report
HTC Desire HD

(PhysOrg.com) -- The United States Computer Emergency Readiness Team (U-CERT) has issued a warning to users of some HTC Android phones regarding a security vulnerability that has been found. The warning pertains to 802.1X WiFi user information and SSID data that can be viewed by rouge applications, taking advantage of a weakness in the OEM Android build of certain HTC phones.

Affected phones allow 802.1X WiFi information to be seen by applications that have access rights to WiFi information stored on the phone. This means errant applications could find their way to a stored SSID (Service Set Identifier - an identifier attached to the header of packets sent to a wide area network), login names as well as passwords. Also, should the phone connect to the Internet, identified information could then be sent back to those that created the application and who are looking for such information. And if the phone also connects to a corporate network, the vulnerability could lead to data being stolen.

According to U-CERT, the phones at risk are:

Desire HD (both "ace" and "spade" board revisions) - Versions FRG83D, GRI40
Glacier - Version FRG83
Droid Incredible - Version FRF91
Thunderbolt 4G - Version FRG83D
Sensation Z710e - Version GRI40
4G - Version GRI40
Desire S - Version GRI40
EVO 3D - Version GRI40
EVO 4G - Version GRI40

HTC, a Taiwanese manufacturer of Smartphones, has had other with their phones in just the past few months, and according to some unofficial sources, this particular vulnerability was discovered by Chris Hessing, a senior engineer with CloudPath Networks. Google and HTC were both apparently notified about the vulnerability last September after it was discovered. Since that time, both have been hard at creating a fix, which is now available to worried owners at HTC’s support site.

Google has also reportedly performed a full scan on all of the applications available for download in the Market, and has found none that have tried to take advantage of the vulnerability, indicating that it’s possible nobody but Hessing and workers at HTC and were even aware of the vulnerability, which means despite the lapse by , it’s likely no one was actually harmed by the problem.

Explore further: Cartier boss snubs 'useful' smartwatches for classic chic

Related Stories

Microsoft reaches licensing deal on HTC phones

Apr 28, 2010

(AP) -- Microsoft Corp. says it has patents covering phones that use Google Inc.'s Android software - but unlike Apple Inc., Microsoft has reached a licensing deal rather than suing over the software.

Recommended for you

Project Jacquard to weave interactivity into textiles

10 hours ago

"Wearables" represents a broad-category of how we will interact with the digital world away from our laptop screens. It embraces arm bands, socks, bracelets, rings and watches. Google is now enhancing that ...

US judge jails Silk Road mastermind for life (Update)

12 hours ago

The American convicted of masterminding the criminal website Silk Road was sentenced in court Friday to life in prison over the online enterprise that sold $200 million in drugs to customers worldwide.

Microsoft Research project can interpret, caption photos

14 hours ago

If you're surfing the web and you come across a photo of the Mariners' Felix Hernandez on the pitchers' mound at Safeco Field, chances are you'll quickly interpret that you are looking at a picture of a baseball ...

User comments : 2

Adjust slider to filter visible comments by rank

Display comments: newest first

Shifty0x88
not rated yet Feb 02, 2012
Uh oh, I have one of those phones, but I am careful in downloading apps from the market.

I only download "trusted" apps, apps which have lots of downloads, are from good companies, and have a good reputation on the internet and from my friends.
satcat
1 / 5 (1) Feb 03, 2012
I also use an app (LBE Privacy Guard, free version) where you can restrict the rights for all the other applications.

However you need to root your phone, have Superuser app installed, and give LBE Privacy Guard full trust

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.