Some HTC Android phones found vulnerable to WiFi password leak

Feb 02, 2012 by Bob Yirka report
HTC Desire HD

(PhysOrg.com) -- The United States Computer Emergency Readiness Team (U-CERT) has issued a warning to users of some HTC Android phones regarding a security vulnerability that has been found. The warning pertains to 802.1X WiFi user information and SSID data that can be viewed by rouge applications, taking advantage of a weakness in the OEM Android build of certain HTC phones.

Affected phones allow 802.1X WiFi information to be seen by applications that have access rights to WiFi information stored on the phone. This means errant applications could find their way to a stored SSID (Service Set Identifier - an identifier attached to the header of packets sent to a wide area network), login names as well as passwords. Also, should the phone connect to the Internet, identified information could then be sent back to those that created the application and who are looking for such information. And if the phone also connects to a corporate network, the vulnerability could lead to data being stolen.

According to U-CERT, the phones at risk are:

Desire HD (both "ace" and "spade" board revisions) - Versions FRG83D, GRI40
Glacier - Version FRG83
Droid Incredible - Version FRF91
Thunderbolt 4G - Version FRG83D
Sensation Z710e - Version GRI40
4G - Version GRI40
Desire S - Version GRI40
EVO 3D - Version GRI40
EVO 4G - Version GRI40

HTC, a Taiwanese manufacturer of Smartphones, has had other with their phones in just the past few months, and according to some unofficial sources, this particular vulnerability was discovered by Chris Hessing, a senior engineer with CloudPath Networks. Google and HTC were both apparently notified about the vulnerability last September after it was discovered. Since that time, both have been hard at creating a fix, which is now available to worried owners at HTC’s support site.

Google has also reportedly performed a full scan on all of the applications available for download in the Market, and has found none that have tried to take advantage of the vulnerability, indicating that it’s possible nobody but Hessing and workers at HTC and were even aware of the vulnerability, which means despite the lapse by , it’s likely no one was actually harmed by the problem.

Explore further: Maker of $33 smartphone hails 'new era' for India

Related Stories

Microsoft reaches licensing deal on HTC phones

Apr 28, 2010

(AP) -- Microsoft Corp. says it has patents covering phones that use Google Inc.'s Android software - but unlike Apple Inc., Microsoft has reached a licensing deal rather than suing over the software.

Recommended for you

Hewlett-Packard recalls 5 million AC power cords

22 hours ago

Hewlett-Packard Company is recalling about 5.6 million notebook computer AC power cords in this country and another 446,700 in Canada because of possible overheating, which can pose a fire and burn hazard.

LG bets on pricey OLED technology as future of TVs

Aug 25, 2014

LG Electronics Inc. announced two new giant OLED TVs with ultra-high definition screens Monday, sticking with its strategy of using the exceptionally expensive OLED display technology.

Giant tablets aimed at families

Aug 20, 2014

Costing a little more than an iPad but standing more than twice as tall, a new pair of giant tablets wants families to share cozier group experiences with technology.

Myo armband and smartglasses set for deskless workplace

Aug 20, 2014

Thalmic Labs, Canada-based makers of the Myo armband, has announced the integration of Myo with smartglasses, with the partnership help of a number of companies pairing the Myo with their products. The gesture-control ...

User comments : 2

Adjust slider to filter visible comments by rank

Display comments: newest first

Shifty0x88
not rated yet Feb 02, 2012
Uh oh, I have one of those phones, but I am careful in downloading apps from the market.

I only download "trusted" apps, apps which have lots of downloads, are from good companies, and have a good reputation on the internet and from my friends.
satcat
1 / 5 (1) Feb 03, 2012
I also use an app (LBE Privacy Guard, free version) where you can restrict the rights for all the other applications.

However you need to root your phone, have Superuser app installed, and give LBE Privacy Guard full trust