Attacks could steal HTC Wi-Fi codes with malicious app

Some HTC mobile devices, running on the Android operating system, contain a software bug that could allow attackers to steal a user's Wi-Fi credentials and network name, known as an SSID.

According to a vulnerability note posted Wednesday by US-CERT, the flaw can be exploited if users have installed applications on affected phones that contain certain permissions.

"There is an issue in certain HTC builds of Android that can expose the user's 802.1X password to any program with the 'android.permission.ACCESS_WIFI_STATE' permission," wrote researcher Bret Jordan, who discovered the weakness with Chris Hessing. "When paired with the 'android.permission.INTERNET' permission, an app could easily send usernames and passwords to a remote server for collection."

Nine models are affected, according to US-CERT. The myTouch 3G and Nexus One are not impacted by the vulnerability.

HTC made a fix available earlier this week, and some phones have have been automatically updated, while other require the patch to be installed manually. Android maker Google, meanwhile, has tested all of the applications in its marketplace to ensure none are trying to take advantage of the vulnerability, Jordan said.

An HTC spokesperson did not respond to a request for comment from SCMagazine.com.

The Taiwanese company, an emerging player in the smartphone and tablet market, had to squash a similar issue last year,