HTC has confirmed that a fix for the recently uncovered security vulnerability in its Android smartphones is in the pipeline, addressing what some security experts suggested was a “massive” privacy issue. “In our ongoing investigation into this recent claim,” the company told Engadget, “we have concluded that while this HTC software itself does no harm to customers’ data, there is a vulnerability that could potentially be exploited by a malicious third-party application”
However, HTC also insists that it has seen no reports of the loophole actually being taken advantage of, with the potential for harm seemingly more theoretical than practical at this stage. Nonetheless, a security update is being worked on now, and which – after some carrier testing – will be delivered OTA to HTC Android phones.
There’s no timeline for its release – HTC says the carrier testing period will be “short” though that’s presumably up to the networks themselves to deliver on – so until then the company points out that people should “use caution when downloading, using, installing and updating applications from untrusted sources.” That’s pretty sensible advice no matter what the situation.
Full HTC Statement:
HTC takes claims related to the security of our products very seriously. In our ongoing investigation into this recent claim, we have concluded that while this HTC software itself does no harm to customers’ data, there is a vulnerability that could potentially be exploited by a malicious third-party application. A third party malware app exploiting this or any other vulnerability would potentially be acting in violation of civil and criminal laws. So far, we have not learned of any customers being affected in this way and would like to prevent it by making sure all customers are aware of this potential vulnerability.
HTC is working very diligently to quickly release a security update that will resolve the issue on affected devices. Following a short testing period by our carrier partners, the patch will be sent over-the-air to customers, who will be notified to download and install it. We urge all users to install the update promptly. During this time, as always, we strongly urge customers to use caution when downloading, using, installing and updating applications from untrusted sources.
