Some HTC Android phones found vulnerable to WiFi password leak

Feb 02, 2012 by Bob Yirka report
HTC Desire HD

(PhysOrg.com) -- The United States Computer Emergency Readiness Team (U-CERT) has issued a warning to users of some HTC Android phones regarding a security vulnerability that has been found. The warning pertains to 802.1X WiFi user information and SSID data that can be viewed by rouge applications, taking advantage of a weakness in the OEM Android build of certain HTC phones.

Affected phones allow 802.1X WiFi information to be seen by applications that have access rights to WiFi information stored on the phone. This means errant applications could find their way to a stored SSID (Service Set Identifier - an identifier attached to the header of packets sent to a wide area network), login names as well as passwords. Also, should the phone connect to the Internet, identified information could then be sent back to those that created the application and who are looking for such information. And if the phone also connects to a corporate network, the vulnerability could lead to data being stolen.

According to U-CERT, the phones at risk are:

Desire HD (both "ace" and "spade" board revisions) - Versions FRG83D, GRI40
Glacier - Version FRG83
Droid Incredible - Version FRF91
Thunderbolt 4G - Version FRG83D
Sensation Z710e - Version GRI40
4G - Version GRI40
Desire S - Version GRI40
EVO 3D - Version GRI40
EVO 4G - Version GRI40

HTC, a Taiwanese manufacturer of Smartphones, has had other with their phones in just the past few months, and according to some unofficial sources, this particular vulnerability was discovered by Chris Hessing, a senior engineer with CloudPath Networks. Google and HTC were both apparently notified about the vulnerability last September after it was discovered. Since that time, both have been hard at creating a fix, which is now available to worried owners at HTC’s support site.

Google has also reportedly performed a full scan on all of the applications available for download in the Market, and has found none that have tried to take advantage of the vulnerability, indicating that it’s possible nobody but Hessing and workers at HTC and were even aware of the vulnerability, which means despite the lapse by , it’s likely no one was actually harmed by the problem.

Explore further: Five features an Amazon phone might offer (Update)

Related Stories

Microsoft reaches licensing deal on HTC phones

Apr 28, 2010

(AP) -- Microsoft Corp. says it has patents covering phones that use Google Inc.'s Android software - but unlike Apple Inc., Microsoft has reached a licensing deal rather than suing over the software.

Recommended for you

Five features an Amazon phone might offer (Update)

19 hours ago

A report this week in The Wall Street Journal that Amazon is planning to release a smartphone has prompted industry analysts and technology blogs to muse about what the device might offer.

Sony's PlayStation 4 sales top seven million

Apr 17, 2014

Sony says it has sold seven million PlayStation 4 worldwide since its launch last year and admitted it can't make them fast enough, in a welcome change of fortune for the Japanese consumer electronics giant.

User comments : 2

Adjust slider to filter visible comments by rank

Display comments: newest first

Shifty0x88
not rated yet Feb 02, 2012
Uh oh, I have one of those phones, but I am careful in downloading apps from the market.

I only download "trusted" apps, apps which have lots of downloads, are from good companies, and have a good reputation on the internet and from my friends.
satcat
1 / 5 (1) Feb 03, 2012
I also use an app (LBE Privacy Guard, free version) where you can restrict the rights for all the other applications.

However you need to root your phone, have Superuser app installed, and give LBE Privacy Guard full trust

More news stories

Airbnb rental site raises $450 mn

Online lodging listings website Airbnb inked a $450 million funding deal with investors led by TPG, a source close to the matter said Friday.

Health care site flagged in Heartbleed review

People with accounts on the enrollment website for President Barack Obama's signature health care law are being told to change their passwords following an administration-wide review of the government's vulnerability to the ...

Under some LED bulbs whites aren't 'whiter than white'

For years, companies have been adding whiteners to laundry detergent, paints, plastics, paper and fabrics to make whites look "whiter than white," but now, with a switch away from incandescent and fluorescent lighting, different ...