We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

HTC Android phones can leak Wi-Fi passwords

A group of HTC Android phones is susceptible to an exploit that can steal Wi-Fi credentials and passwords and send them to attackers.

The exploit relies on attackers creating rogue applications to take advantage of vulnerabilities in the Android build HTC uses on some of its phones, according to a post by the United States Computer Emergency Readiness Team (US-CERT).

Users with affected phones should go to HTC's support site for software updates, US-CERT says.

TIPS: Tricks for upgrading your Android phone 

The affected Android builds expose 802.1X passwords to applications on the phones that have permission to access the Wi-Fi state of the phone. The flaw doesn't allow access to the 802.1X settings themselves, it does allow viewing Wi-Fi credentials, according to a description of the flaw at the My War With Entropy blog by Bret Jordan.

So an application could gain access to stored SSIDs of Wi-Fi networks, user names and passwords. If the application also has Internet-access privileges, it could send along the stolen credentials to attackers.

If the stolen credentials are for corporate networks, they could be used to target data on those business networks, Jordan writes.

According to US-CERT, affected phones are:

• Desire HD (both "ace" and "spade" board revisions) - Versions FRG83D, GRI40

• Glacier - Version FRG83

• Droid Incredible - Version FRF91

• Thunderbolt 4G - Version FRG83D

• Sensation Z710e - Version GRI40

• Sensation 4G - Version GRI40

• Desire S - Version GRI40

• EVO 3D - Version GRI40

• EVO 4G - Version GRI40

HTC and Google were told about the flaw last September and have been working to fix the problem and arrange for public disclosure. Jordan describes the companies as responsive and good to work with.

Read more about wide area network in Network World's Wide Area Network section.


IDG UK Sites

Best Christmas 2014 UK tech deals, Boxing Day 2014 UK tech deals & January sales 2015 UK tech...

IDG UK Sites

LED vs Halogen: Why now could be the right time to invest in LED bulbs

IDG UK Sites

Christmas' best ads: See great festive spots studios have created to promote themselves and clients

IDG UK Sites

Stop running out of cellular data on your iPhone, see which apps use the most data