
http://www.androidpolice.com/2011/10/01/massive-security-vulnerability-in-htc-android-devices-evo-3d-4g-thunderbolt-others-exposes-phone-numbers-gps-sms-emails-addresses-much-more/
Be a part of the community.
It's free, join today!

Wait -- these things never happen in closed systems?
http://gizmodo.com/5603319/new-apple-security-breach-gives-complete-access-to-your-iphone
In both instances, there is no documented case of anything actually breaching. Yes, it's a hole that needs to be addressed. But proof of concept and in the wild are two different matters.
Quote:


Android stopped being even "open", not to mention open a while ago -- Google seems to have dropped all pretense of releasing Android 3 or later source code. And with Amazon using Google's prior "openness" against them I doubt very much anything will change.
So lets call the problem by its true name -- the non-integrated business model, which offers up more possible points of failure. HTC is one of them.
As I understand it, the information that can be taken is nothing unusual provided the app had certain rights. The security flaw is that HTC only put Internet Access rights on this data, which means that in theory, an app that looks like it can only access the internet could be programmed to access more sensitive data through this hole. However, it's far easier to have a program slip in the rights necessary to access this data directly from the phone and not have to exploit an HTC specific vulnerability that affects a small number of actual phones.
Tempest in a teapot? Pretty much. The bigger problem is that most people don't read the security stuff when they install programs.