Privacy of Millions of HTC devices at risk

More than 18 million smartphones and other mobile devices made by HTC are at risk vulnerable to many security and privacy issue...

The Federal Trade Commission charged HTC with customizing the software on its Android- and Windows based phones in ways that let third-party applications install software that could steal personal information.

The vulnerabilities placed sensitive information about millions of consumers at risk and potentially permitted malicious applications to send text messages, record audio and install additional malware without a user’s knowledge or consent. 

FTC identify many vulnerabilities including, insecure implementation of two logging applications i.e Carrier IQ and HTC Loggers. The agency also found programming flaws that let third-party apps bypass Android's permission-based security model.

Flaws in the security system could also give third-party apps access to phone numbers, contents of text messages, browsing history and information like credit card numbers and banking transactions.

The Federal Trade Commission said HTC agreed to develop and release software patches to fix vulnerabilities found in millions of HTC devices. 

“The company didn’t design its products with security in mind,” Lesley Fair, a senior lawyer in the commission’s Bureau of Consumer Protection, wrote in a blog post.

“HTC didn't test the software on its mobile devices for potential security vulnerabilities, didn't follow commonly accepted secure coding practices and didn’t even respond when warned about the flaws in its devices.”

It also said the settlement also requires HTC America to set up a comprehensive security program when it is developing its devices, in order to avoid security risks