Major HTC Android Security Flaw Revealed

If you’re one of the many people who uses one of Taiwanese manufacturer HTC’s Android mobile phones, you may want to sit down. See, it turns out that due to a security flaw in phones like the EVO 3D, EVO 4G, and Thunderbolt (i.e. phones running the newest version of HTC Sense; older phones seem not to be affected), any application you installed could get access to some of your private data easily, including (but not limited to):

• a list of user accounts for the phone, including email addresses
• last known network and GPS locations, as well as other previous locations
• SMS data, including phone numbers and probably actual text as well
• system logs that include lots of other data

That sounds pretty bad, but it’s actually just the tip of the iceberg. According to the folks at Android Police who discovered this issue, the flaw — which can be exploited by any app with permission to access the internet — potentially reveals basically everything about your phone right down to the battery charge status and history.

Ready for the worse news? There’s no way for you to fix this issue unless you’re willing to root your phone. That might be a good option for the tech-savvy, but it’s a bit complex and it voids your warranty, so most users will probably be stuck waiting for an update from HTC. If you do want to root your phone, Android Police recommends you delete the HtcLoggers.apk file, which is apparently what’s keeping track of all your data and sharing it with everyone.

HTC has already offered a response, although it’s a bit vague for our taste:

“HTC takes our customers’ security very seriously, and we are working to investigate this claim as quickly as possible. We will provide an update as soon as we’re able to determine the accuracy of the claim and what steps, if any, need to be taken.”

Still, better than nothing! Here’s hoping there’s a fix available ASAP.

Here’s a video rundown of the issue, also from Android Police:

[Android Police via Gizmag and Gizmodo]