HTC Phones Suffer Major Security Exploit

We will provide an update as soon as we're able to determine the accuracy of the claim and what steps, if any, need to be taken.

HTC says they are verifying the problem and will update soon:
»twitter.com/#!/Htc

But not everybody likes to root their phones.

HTC takes claims related to the security of our products very seriously. In our ongoing investigation into this recent claim, we have concluded that while this HTC software itself does no harm to customers' data, there is a vulnerability that could potentially be exploited by a malicious third-party application. A third party malware app exploiting this or any other vulnerability would potentially be acting in violation of civil and criminal laws. So far, we have not learned of any customers being affected in this way and would like to prevent it by making sure all customers are aware of this potential vulnerability.

HTC is working very diligently to quickly release a security update that will resolve the issue on affected devices. Following a short testing period by our carrier partners, the patch will be sent over-the-air to customers, who will be notified to download and install it. We urge all users to install the update promptly. During this time, as always, we strongly urge customers to use caution when downloading, using, installing and updating applications from untrusted sources.

Just in time for the Iphone 5 release

Trevor Eckhart. I'm a Systems Administrator in Connecticut. Skilled with SQL, Citrix, Cisco, Windows Server03/08, Android and more.

Artem Russakovskii - a local San Francisco geek who currently works at Plaxo and enjoys hacking Android, PHP, CSS, Javascript, AJAX, Perl, and regular expressions, working on Wordpress plugins and tools, tweaking MySQL queries and server settings, administering Linux machines

Doesn't change the fact that HTC has a very real and dangerous exploit in their software, which they've acknowledged: »www.androidpolice.com/2011/10/04···shortly/

Apple had nothing to do with this. The website sells Android apparel and the people who discovered this are security researchers:

So it seems the vulnerability is from a potential app that would have to be downloaded from a third party site.

Seems obvious that smart phones are the next target for hackers trying to gather personal info. I don't use my phone as a data bank for this reason.

What are they gonna do with my contacts?

The vulnerability is from an application HTC installs on their phones: HtcLoggers.apk. This vulnerable app comes with the HTC phone out of the box.

If it allows any application with internet access to transmit private data, it's already too late. The offending app is already on your phone. And I'm sure everyone thoroughly reads every single app's permissions before downloading/installing it from the market.

It's no different then Window users blindly clicking allowed when the request permission popup comes up, or Linux users running as root.

Not saying that it's something that doesn't need fixed, just saying it might not be as big of a deal as it sounds.

CyanogenMod FTW!