Slashdot Mirror
Security Vulnerabilities On HTC Android Devices
revjtanton writes "In recent updates to some of its devices, HTC introduced a suite of logging tools that collected information. Lots of information. LOTS. Whatever the reason was, whether for better understanding problems on users' devices, easier remote analysis, or corporate evilness — it doesn't matter." That's because "any app on affected devices that requests a single android.permission.INTERNET (which is normal for any app that connects to the web or shows ads)" on one of these phones can now grab all sorts of interesting bits from the logged data.
No one wants to track us!!
Not the point. The point is that a third party app can grad the data and send it off to an unknown location without asking permission first. However, that assumes you have an untrusted app installed with the internet permission flag set to true.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
If you are rooted, you can use Titanium Backup to uninstall HTC Loggers or you can manually delete HTCLoggers.apk from /system/app/.
mmm...muffins
Untrusted apps? You mean I can't trust my cute little Bonzi Buddie? Shame on you, you nasty paranoid person! :)
Therefore, by the (faulty) logic you're using, you're just a cow with a keyboard - osu-neko (2604)
Even more reason to root and flash with CyanogenMod or other custom firmware of your choice.
Seems to be a mind is willing, but the flesh is weak situation with the droid devices. Certainly the permissions model makes lots of sense for the type of device, but the implementations are wanting.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Seriously, why bother - users don't actually care whether an app needs internet access or not, they just use the app anyway. For example, I've developed an app doesn't require internet access, yet it is still less popular than a similar app (which has less functionality) that happily uploads your private data to it's servers.
Honestly, if the users themselves don't mind sending something like their menstruation data to a third-party, why bother with an app that guarantees privacy? The privacy apps will just make less money due to having less marketing info from the users, and being unable to mine that data.
The market for users who care about their privacy is way too small to count. All users will happily allow something like "Angry Birds" to have internet access, even though it is obvious that it doesn't need it.
I'm a minority race. Save your vitriol for white people.
For grumpy HTC owners that want to bitch a little or get them to fix things... http://www.htc.com/us/about/contact-by-email
My HTC Desire got hacked/used as some sort of proxy/relay by someone coming from an APNIC IP address who gained access to my GMail account and sent/received emails while I was busy driving home from work one evening. Google email confirmed that my gmail account was accessed at the time/date via my phone's IP address, and I found evidence in my phone that it had been accessed by an APNIC IP address at that time too. Luckily I caught this breach immediately after I got home and was able to re-secure my gmail account with a new password. Since my phone was already rooted and S-OFF'ed, I immediately downloaded and installed CM7. I've experienced no further security breaches on my phone since.
How do I delete this new attack from HTC? If I can't just delete it, but instead I have to root the phone and install an Android OS not from HTC or my carrier, where is the complete list of what I'll lose when I do so? And instructions for doing it?
And where's the NY attorney general phone#, so I can report this hellish violation of any contract I had with HTC, and general privacy invasion?
--
make install -not war
The security community needs to stop pushing mobile based token authentication. There is no reason why mobile OS's should get some kind of protected status vs their notebook counterparts. In my neck of the woods bad guys just forward all a victims calls for a few hrs anyway regardless of OS but clearly the trojan writers can make the usb jump to the users phone (EU charging mandate now) and carry on the same old tricks.
Just recently, Verizon pulled the Gingerbread update for the Thunderbolt. It had been rolled out and now Verizon is pushing it back a couple of weeks to fix bugs. Hopefully this is among the bugs that get fixed. Minus the short battery life, the Thunderbolt should be a really good phone. Unfortunately, the software has been lacking in general. This is just one more blow...
I can't see where a separate permission to allow localhost access would help at all. For one thing, how many people would know what that meant - at all? They would just mentally lump it with the internet permission if anything anyway.
For another, I can imagine there are some valid uses of connecting to a local port, possibly even some kind of IPC thing for a single application that has multiple components.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Every time you install an app, a list of permissions to be granted is present to the user for their permission. Now, it may be the case that most users just blindly hit "accept," but that's not an OS issue.
Yes it is. By having a security model that makes it more likely users will accept, that OS has introduced a security flaw.
A better approach is to grant permission at first time of access to a resource, so that you can make a judgement in context of what the app is asking for. Possibly some permissions should be asked for up front anyway, but not all... And by breaking them apart users would think more about granting them.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Why? It clearly isn't for ads, perhaps its for DLC???
Even though I'm not sure exactly what Angry Birds on Android needs (aside from DLC which I know they do regularly), I can think of a lot of reasons why pretty much any game would want internet permissions:
* Highscores
* Achievements
* Reduce level size on device
* Tweeting to friends about game (yes, many games integrate with social networks).
* web pages with game help material that you wanted to be able to keep more dynamic.
* news feed for game users
"There is more worth loving than we have strength to love." - Brian Jay Stanley
N/C
Vote monkeys into Congress. They are cheaper and more trustworthy.
Good Job HTC.
You know that sounds like a solid idea, but I scratch my head at the specific implementation of it. If you say that internet connections for ads are a separate permission, then would Google maintain a white list of ad providers? And then for ad providers, there'd need to be some policing to check that info going to the ad servers doesn't contain personal info.
Google does not need to maintain a whitelist of ad servers. Google needs to *be* the ad server and make it so that if you want to stream ads to android phones, you hire Googles ad services to do it. That way they can run a tight ship on security of those ads and make sure nobody tries any shenanigans thru 3rd party ad servers that might be located anywhere on the planet and operated by unscrupulous jerks. Letting an android phone slurp ads from just anybody's server anywhere on teh internet is epic fail for security.