Attacks could steal HTC Wi-Fi codes with malicious app

Share this article:

Some HTC mobile devices, running on the Android operating system, contain a software bug that could allow attackers to steal a user's Wi-Fi credentials and network name, known as an SSID.

According to a vulnerability note posted Wednesday by US-CERT, the flaw can be exploited if users have installed applications on affected phones that contain certain permissions.

"There is an issue in certain HTC builds of Android that can expose the user's 802.1X password to any program with the 'android.permission.ACCESS_WIFI_STATE' permission," wrote researcher Bret Jordan, who discovered the weakness with Chris Hessing. "When paired with the 'android.permission.INTERNET' permission, an app could easily send usernames and passwords to a remote server for collection."

Nine models are affected, according to US-CERT. The myTouch 3G and Nexus One are not impacted by the vulnerability.

HTC made a fix available earlier this week, and some phones have have been automatically updated, while other require the patch to be installed manually. Android maker Google, meanwhile, has tested all of the applications in its marketplace to ensure none are trying to take advantage of the vulnerability, Jordan said.

An HTC spokesperson did not respond to a request for comment from SCMagazine.com.

The Taiwanese company, an emerging player in the smartphone and tablet market, had to squash a similar issue last year,

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Millenials improve security habits, more interested in cyber careers, still need guidance

Millenials improve security habits, more interested in cyber ...

Raytheon's second annual survey on the online and security behavior of Millennials shows improvement but still a long way to go.

Pakistani man indicted over spyware app creation

Hammad Akbar created StealthGenie, which allowed the purchaser to secretly monitor a cell phone's communications.

FDA finalizes guidelines on medical device, patient data security

The recommendations are aimed at providing better protecting patient health and data, as well as hoping device manufacturers take into account cybersecurity risks in the early stages of development.