HTC admits some phones are vulnerable to specific Android requests

According to foreign media reports, HTC has admitted that some of the company's mobile phones to deal with specific Android requests in the form of loopholes, may thus expose the mobile phone connected to the WiFi network security credentials.

Researchers Chris Hess (Chris hessing) and Brettes Jordan (Bret Jordan) found on the affected HTC phones with Android.permission.ACCESS_WIFI_ Any Android application of state permissions can invoke the. toString () Directive on wificonfiguration to view all security certifications for the wireless network.

If you combine Android.permission.INTERNET permissions, hackers can obtain relevant details and send them over the Internet to a remote server.

This vulnerability affects the following phones:

Desire Hd-versions frg83d, GRI40

Glacier-version FRG83

Droid incredible-version FRF91

Thunderbolt 4g-version frg83d

Sensation Z710e-version GRI40

Sensation 4g-version GRI40

Desire S-version GRI40

EVO 3d-version GRI40

EVO 4g-version GRI40

HTC posted an announcement on its support website on January 31 to warn users of the vulnerability: "HTC has developed a patch to fix a small wifi problem on some HTC handsets." Most phones have received this patch through regular updates. However, some phones will need to be manually downloaded to repair on line. Please find out more about this patch next week, if you need to update your phone, please download it manually. ”

The good news is that most HTC phones will automatically fix the loophole by patching, but some phones require users to manually download the patch. HTC says users should see more details at the website next week.

Hess and Jordan discovered the problem on September 7, 2011 and worked with HTC and Google in the next few months to find out why.

This vulnerability requires users to install applications that are specific to user information. The impact of this vulnerability is small, in fact such applications will not be pervasive, but security risks do exist.