Interpac Business and Migration Solutions Melbourne Australia

(October 6, 2011)

Smartphone maker HTC has admitted to some of its smartphones being vulnerable to an attack that allows a hacker to find out where you are, who you have called and sent text messages to and disable your phone remotely.

Yesterday Fairfax Media reported on a vulnerability in HTC Android smartphones that could be exploited by a malicious app that is granted access to the internet, which most apps require. Once granted access such an app could then gain access to data that was shown to be exposed.

"... There is a vulnerability that could potentially be exploited by a malicious third-party application," the company said in a statement yesterday evening. "So far, we have not learned of any customers being affected in this way and would like to prevent it by making sure all customers are aware of this potential vulnerability."

The company said it was working "very diligently to quickly release a security update" that would resolve the issue on affected devices. "Following a short testing period by our carrier partners, the patch will be sent over-the-air to customers, who will be notified to download and install it. We urge all users to install the update promptly."

Affected devices in Australia, according to the US security experts who uncovered the vulnerability, included the HTC Sensation, sold on a plan with Telstra, and the HTC EVO 3D, sold by both Vodafone and Telstra.

Australian security expert at Stratsec, Nick Ellsmore, said yesterday that from a user perspective the security flaw exposed was "far more serious than the iPhone 'location tracking scandal', which turned out to mostly be a non-event once the details emerged, or the Facebook 'like' button tracking after log-out of last week".