Live data from Hacker News

Massive data stealing vulnerability found in many HTC Android phones

androidpolice.com

21–30 of 48 posts

Re: Massive data stealing vulnerability found in many HTC Android phones

#21
post #6

Which is why I am glad I got a firewall on my phone and whitelist selected applications to have internet access.

You should read the article. Apparently any app that you give permission to use the Internet can leak all your data. Are you absolutely positive that every single free app you download is safe?

I only let apps I trust access the internet.

Re: Massive data stealing vulnerability found in many HTC Android phones

#22
post #19
post #8

Android is not having a good time with security this week. The Samsung Galaxy S II on AT&T is very easy to unlock without the PIN or password. http://www.bgr.com/2011/09/30/major-security-flaw-lets-anyon...

These issues are manufacturer dependent and not Android issues.

Sure, I was just talking about reputation.

Re: Massive data stealing vulnerability found in many HTC Android phones

#23
post #19
post #8

Android is not having a good time with security this week. The Samsung Galaxy S II on AT&T is very easy to unlock without the PIN or password. http://www.bgr.com/2011/09/30/major-security-flaw-lets-anyon...

These issues are manufacturer dependent and not Android issues.

They are issues for Android the brand.

Re: Massive data stealing vulnerability found in many HTC Android phones

#24
post #6

Which is why I am glad I got a firewall on my phone and whitelist selected applications to have internet access.

At least with droidwall, non-whitelisted apps are perfectly able to connect to local ports (in fact I've got a few apps that don't get internet access, and instead get ssh port forwards).

And it looks like (at least on CM) non-whitelisted apps can make DNS queries as well (so they can still send the data home).

Re: Massive data stealing vulnerability found in many HTC Android phones

#25

This is an awesome reason to root your phone the second you get it. I've done so to both of my Android phones. You know that cyanogenmod is safe from this kind of blatant wiretapping, and on top of that, you don't have to worry about hassling with it when you need to tether, or when you want to install an application that requires root permissions to function well. :)

Actually sometime back CM rejected patches that would allow you to prevent apps from collecting the device ID (which is obviously quite privacy invasive). I still run CM, but boy do I wish an open-source distribution would spring up that actually respects the phone's owner.

Re: Massive data stealing vulnerability found in many HTC Android phones

#26
post #21

Earlier quoted context omitted.

You should read the article. Apparently any app that you give permission to use the Internet can leak all your data. Are you absolutely positive that every single free app you download is safe?

I only let apps I trust access the internet.

How does that help when your firewall can leak the very same data?

Re: Massive data stealing vulnerability found in many HTC Android phones

#27
post #18
post #16

Earlier quoted context omitted.

One of the affected models, the Thunderbolt, only now started getting updates to Gingerbread this week. That is, until Verizon halted it due to a major usability bug that should have been identified easily in carrier testing (voicemail notifications don't work). Given that it took it took HTC this long to get an update to an Android version that's been available in source since December and they still managed to mess…

Surely the blame there is on Verizon. My aging, carrier-free HTC Nexus One gets regular updates.

On my (contractless) Galaxy S2 - OTA updates happen never, I have to connect to a Windows box for updates.

Do you know how OTA updates are pushed out for the non-Google Android phones that are bought without a contract?

Re: Massive data stealing vulnerability found in many HTC Android phones

#28
post #20
post #18

Earlier quoted context omitted.

Surely the blame there is on Verizon. My aging, carrier-free HTC Nexus One gets regular updates.

There are only two ways I recommend Android - use a Google-branded phone that Google will provide complete OS support for, or go it alone with OS updates from a 3rd party. For non-geeks the first option is the only viable one, IMHO. You've obviously settled on the same conclusion.

Could you point me in the right direction for 3rd party?

Re: Massive data stealing vulnerability found in many HTC Android phones

#29
Does this issue allow me to close a 2 years contract with Orange before the end of the contract, without paying for the remaining months?

I'm pretty sure that even if HTC fixes this mess I would have to wait forever for Orange to push the update with its custom sw.

Post reply on HN