Researchers uncover 'massive security vulnerability' in HTC Android phones

HTC-manufactured Android smartphones including the Evo 4G and Thunderbolt may be subject to a "massive security vulnerability" granting installed applications unauthorized access to personal user data.

AndroidPolice.com and security researcher Trevor Eckhart report that the most recent version of HTC's customized Sense UI contains a flawed logging application giving installed apps access to a wealth of device, operating system and usage information, even if the consumer only granted the app access to the device's Internet capabilities for the purposes of uploading and downloading data. The data in question--including build number, network information, list of installed apps, user IDs and full memory info--could theoretically be sufficient to clone the device, the report states.

The AndroidPolice.com report notes that it is unclear why HTC installed the logging tools, adding that the device maker neglected to secure the data being collected. The report goes on to indicate that is not possible to remove the vulnerability without rooting the device or deleting the Sense UI.  

HTC tells VentureBeat it is investigating the issue. "HTC takes our customers' security very seriously, and we are working to investigate this claim as quickly as possible," a spokesperson said. "We will provide an update as soon as we're able to determine the accuracy of the claim and what steps, if any, need to be taken."

For more:
- read this Android Police article

Related articles:
HTC confirms interest in acquiring its own mobile operating system
HTC buys $300M stake in Dr. Dre's Beats to upgrade mobile audio
HTC acquires Dashwire to boost cloud computing aspirations
HTC scoops up S3 Graphics to enhance mobile game visuals
HTC boosts content efforts via Saffron Digital investment