a bug in HTC's Sense skin that allowed for remote file access on a handful of smartphones, then the whole Carrier IQ debacle, which was demonstrated mostly on HTC's hardware. The latest snafu was uncovered by the United States Computer Emergency Readiness Team, which states that a considerable amount of HTC phones are running flawed software that allows third-party applications access to encrypted WiFi passwords. The US-CERT team published their findings on the Homeland Security website yesterday.
exposed to any website they visited from their mobile phones. While not a malicious attack, a setting in O2's network was broadcasting its customers phone number in addition to standard browser data like user agents, device type and screen size. This morning Android phones and other O2 devices stopped broadcasting mobile phone numbers, indicating that the security hole has been patched. O2 still hasn't spoken publicly on the issue.
told Android Community that the company does not use Carrier IQ software in any of its products. Canadian carrier Rogers joins them today, also stating that Carrier IQ is not present on any of its devices. A company spokesperson confirmed on Twitter that none of the phones or tablets in their lineup use the software.
Carrier IQ's support software has been monitored closely by Android security watchdogs for the last few weeks. After an embarrassing public relations snafu, the company stated that their software does not record personal information, despite the findings of an independent security analyst. But The Register reports that same analyst has now shown the Carrier IQ software logging keystrokes in real time, and transmitting them over an unsecure wireless connection. Carrier IQ is, in a word, busted.
threatening an XDA-Developers member with legal action over exposing embarrassing privacy violations in their network management software, Carrier IQ has retracted its demands and issued a public apology. The retraction came after the EFF came to TrevE's legal aid and blogs and news sites around the Internet slammed the company's actions. Recognizing a public relations nightmare when they saw one, the company said it was "deeply sorry for any concern or trouble that our letter may have caused Mr. Eckhart." The press release went on to say that Carrier IQ's software doesn't record keystrokes, location or usage information, in direct opposition to TrevE's findings.
HTC's recent Sense UI issue don't help. So when XDA-Developers poster TrevE found some disturbingly direct violations of Android users' privacy in the Carrier IQ tracking software, he made it known to as many people as possible, with citations and evidence as needed. Now Carrier IQ has sent him a cease and desist letter, threatening legal action if he doesn't remove his research and allegations. The Electronic Frontier Foundation, a legal defense group for technology enthusiasts and issues, has offered him assistance.
current version 7 have raised the eyebrows of some users over at the ever-inventive XDA-Developers forum. According to forum poster "Fnorder", the new Webzine feature records every link, search and visited page and sends them to a remote server. If true, the breach of Dolphin users' privacy is very disturbing indeed. UPDATE: In response to the security and privacy concerns, the makers of Dolphin Browser have disabled the Webzine feature. According to the developer, user browsing data was never saved, and users' security has not been compromised.
security vulnerability in its Android smartphones is in the pipeline, addressing what some security experts suggested was a "massive" privacy issue. "In our ongoing investigation into this recent claim," the company told Engadget, "we have concluded that while this HTC software itself does no harm to customers' data, there is a vulnerability that could potentially be exploited by a malicious third-party application" However, HTC also insists that it has seen no reports of the loophole actually being taken advantage of, with the potential for harm seemingly more theoretical than practical at this stage. Nonetheless, a security update is being worked on now, and which - after some carrier testing - will be delivered OTA to HTC Android phones. There's no timeline for its release - HTC says the carrier testing period will be "short" though that's presumably up to the networks themselves to deliver on - so until then the company points out that people should "use caution when downloading, using, installing and updating applications from untrusted sources." That's pretty sensible advice no matter what the situation. Full HTC Statement:
HTC takes claims related to the security of our products very seriously. In our ongoing investigation into this recent claim, we have concluded that while this HTC software itself does no harm to customers' data, there is a vulnerability that could potentially be exploited by a malicious third-party application. A third party malware app exploiting this or any other vulnerability would potentially be acting in violation of civil and criminal laws. So far, we have not learned of any customers being affected in this way and would like to prevent it by making sure all customers are aware of this potential vulnerability. HTC is working very diligently to quickly release a security update that will resolve the issue on affected devices. Following a short testing period by our carrier partners, the patch will be sent over-the-air to customers, who will be notified to download and install it. We urge all users to install the update promptly. During this time, as always, we strongly urge customers to use caution when downloading, using, installing and updating applications from untrusted sources.