Android Security Elevation With HTCLoggers.apk (EVO 3D/4G, Thunderbolt, more)

[DeLL116]

get snake pliskin over here and have him put in the world code.

[jeserkin]

Does anyone know is this problem already solved on Android 2.3.5, HTC Sence 3.0 and HTC Desire S?

[XSturb]

On my HTC Sensation it shows port 0 and I'm not able to change that. And it also shows N/A. So does that me that I don't have HTC Logger?

[tripware]

Suppose the only way is to unplug.

[3dkiller]

HTCP criminals, spyware phone's

[NMorgan4]

Trevor, How would one find out if this spy program is installed on an Andorid based Samsung Epic 4G? Thanks

[johnston336]

@NMorgan4

This program is HTC specific.

[Activist4America]

Go to Wikipedia and search: Echelon_(signals_intelligence)

[Activist4America]

You want to know how long they have been tracking all communications, of everybody? Have you heard about ECHELON? They've heard you. Now read about them.

Echelon_(signals_intelligence)

[ronnie3027]

can you maybe do a vid with this app on a samsung galaxy s2??? i would appriciate it much

[HeadleyBrett]

@ronnie3027 WIth the tv off in the background :-)

[AndroidiApp]

OK good work, not sure its any major problem if anyone wants to harvest location information just pack it into a juicy enough app and ask for the permissions - many will just give it, not sure what the big deal is with location information as the phone leaks this anyway, the various network ids are broadcast anyway.

So all in not a major issue the whole thing is a slight bleed over the boundaries of permissions and nothing to set the world on fire as I see it.

However good work.

[ccyungin]

um......nerd.

idk why i watched this shyt,i have no clue of what was going on -____- why would people carrreee!!

why would you go through all this "letters" crap to try and discover they track your activity without telling you.......do you think HTC or somebody finna track you down and kill you??!

[AndroidiApp]

@ccyungin

So you are so ill-educated you don't understand - is that your foundation for being so rude?

[OO7Lonestar]

@ccyungin You really dont get the point of this video do you?, its general message is beware of some apps on the android market place because they can be doing more than they say they are doing. Just thought i would point that out cos you dont sound too smart. :)

[gamefreak964]

And the Apple sells all your personal info...

Google it I'm not lying

[santoz1985]

In fairness though, Apple have being tracking their users for years and probably know more about them than they know themselves.....

[valakas7]

2 dislikes

1⁰ = HTC representitive

2⁰ = FBI

[FullMentalComplex]

This is why im sticking with iPhone. since 1g, and soon 5.

[DaManCJ]

@FullMentalComplex lol All rooted Roms dont have this issue. HTC messed up and just needs to fix it, thats all. BTW all iDevices/iOSs has been rooted/jailbroken to date last time I checked. Proving that they have vulnerabilities as well. It can even be jailbroken from a website w/o rebooting. Think about if a site targets that same loophole but hid itself. Read up on it. A safer iDevice is 1 ya jailbreak to fix the vulnerabilities. Same goes for Androids, root = safer.

[WiseGuy02]

@FullMentalComplex Good plan. Cause they've never had any issues. bahahahaa

[TrevorEckhart]

not my location guys :) im behind an airave thats why i had no problem showing it. To make this clear, htcloggers.apk is (obviously) only something on HTC phones, it appears to be on alot of the US branded 3.0 or greater sense handsets.

[AndroidiApp]

@TrevorEckhart

Its good you have done this, while I really don't think its a major flaw as the information could just be asked for and most users agree to everything without worrying its good work.

What might be good is to shove the code back behind a report writer that was flexible in formatting so one could look at more data easier, it would be interesting to know how Android interacts with the app usage stats, does it control the auto background start of apps maybe clear the logs &test?

[saquibs20]

he showed his location at 6:45.

[endale]

makes my choice easier (SGSII)

[Top0ne]

This is why I root. HTC get your shit together or Samsung will replace you.

[arqbrulo]

Scarry..... and now I know where you live >:)

[AlexOnVinyl]

Can anyone tell me whether this is collecting passwords at all?

[tellsy1997]

Does incredible s contain tis problem?

[Apolikamixitos]

Thank you for the POC .

Actually i have just some questions, Which version of Android is affected with this vulnerability ? is it only for the version of Android installed in this HTC or in all the HTCs ?

[DazJamesW]

If this affects the original Desire they might have fun patching it - most of them have very, very little space left because of the falsely advertised tiny internal memory.

[gurmindermushiana123]

this one of the many reasons to buy wp7......

[aussieleboman]

That's bloody scary. I had the htc desire hdfor 10 months. would that have been vulnerable. Ive got SGSII...thats ok right? its just HTC?

[sgindy]

@aussieleboman,

Yes, this problem ONLY applies to HTC CRAP, and what's even worse is that this is not the first time having problems with this crappy HTC Sense UI. It almost took them 5 months to look into the issues of the OBEX FTP Service Directory Traversal in HTC CRAP with Android 2.1 and Android 2.2, and we are still waiting for the security fix for the problems...

Stay away from HTC CRAP like PLAGUE. ;)

[mxc8mxc]

android sux

[mihayyyyyy]

@mxc8mxc sure it does... go back to your feature phone

[DigitalGamma]

I'm suprised that it still tracks you even after you disable the service. However, I also don't really mind about being tracked. All HTC will find out is that I check my Facebook a lot... Well, that was before I installed CM7...

Also, the "$" doesn't mean that you're not rooted. When I had my stock rom rooted I had to type su to get root permissions.

[JayStricklo]

Class action law suit anyone? Anyone?

[timlewis500]

@JayStricklo I own a thunderbolt. It is absolutely the worst dumb-phone I've ever had. Glitchy and packed with HTC bloatware that you can't un-install and automatically starts up at random times. Some of these bloatware apps are openly using personal data and reporting it with out any way to opt out of them.

I will totally sign on to a class action lawsuit. HTC knew what they were doing and did it anyway.

[musmoh19]

@JayStricklo me, pick me !

[tomastsega]

crap..... i have a evo 3d 0.o

[acceleratorist]

Does this vulnerability apply to HTC phones running non-Sense ROMs?

[jakeroot2]

I have a Desire HD running MIUI. I'm assuming this doesn't apply to me, correct?

[pitchbend]

that's cool and all, but dude you are missing a great episode of how I met your mother! go watch it, the turn the TV off and reshoot the video...

[AnarchyEngineer]

Does this rather large security issue affect the original Desire and/or Sensation?

[iToasterman]

iTrolls in 3... 2... 1...

[Wilbur665]

Should have more ambient light to prevent the screen from blowing out the light levels.

[RCoster47]

That's f*****g COOL!

[lolnameless]

@360ThickQuinking360 but dislike can also mean he dislikes HTC

[AlexGP90]

Basically, I think that all smartphones have one way of another of lloging your data, be it Android, iOS, Bada, whatever. You want security? Use a dumbphone like 1100 from Nokia (although, it`s not 100% sure you`re safe with that one either.)

[suloch]

Good work. 

[SecondFry]

Unbelievable. I loved HTC for their smartphones and wondered if I'll have native Sense, I would use it.

Now, only AOSP or mod's (Cyanogenmod, of course). Thanks for video!

[stcottier]

I just rooted my phone last night. Still learning about the different roms. Excellent informaiton. Any response from HTC yet? Needless to say the stock rom is being removed when I figure out how to apply another rom.

[Krishilbun]

Im glad you managed to uncover this, thanks for doing the right thing!

[360ThickQuinking360]

1 dislike = HTC representitive

[djskyline701]

I wonder if Droidwall would help. I dont want to be involuntarily tracked/stalked :'(

[fafeifa]

you should change the tittle to something like "htc violating your privacy" so more people will see it and puts more pressure on these crooks.

[wwjoshdew]

TrevE, HOLY COW! And judging by the title, your video was .m4v format. So you're running CM7 on your EVO4G, correct? Because if you look at my channel, I have CM7 alpha 3 on my EVO3D right now. So I don't have to worry about this. I am NOT going back to the stock EVO3D rom after this... This is just wrong.

[kylez64]

HTC needs to change this shit very soon or they lost a very loyal customer.

I just checked this out with root explorer and removed it.

[accesser]

Excellent work thank you, Lets hope we see some patches

[monkeychef23]

I can't believe HTC is doing this crap again. Something needs to be done.

[beanbean50]

let's hope HTC will stop all this monkey business, it's not good for their business

[dostimexist]

Thank you for your work and time on finding this out and Explaining it. This is actually scary. Lets see what htc's reaction is. Thanx again for your nice work.

[astroblitz1]

@dostimexist How the fuck is this scary? It is not. They do not give a rats ass about you.

It is interesting. Because HTC is lying/or has a bug that they need to fix. HTC does not care about your location. You are Joe Shmoe. They do not care. You are of no importance to them. Stop thinking your life is in jeopardy because HTC knows your GPS data.

Morons.

[dostimexist]

@astroblitz1

Scary in the way that any aplication can use this data. Not only htc. And its not just the gps location. It more info about your phone.

copied from xda"HTCLogger allows any app that has access to android.permission.INTERNET on devices such as the evo3d to obtain full access to query sensitive info such as network/appusagestats/meid/esn­/phone#/past 10 location broadcasts and last known locations/and more."

[SporadicMuffin]

@astroblitz1

"Morons."

Pot... Meet kettle. 

[Nemephosis]

@astroblitz1 There's always at least one dumb fuck too stupid to understand their own privacy... thanks for being that one. Keep that status quo alive!

[WackyAnimation]

@astroblitz1 Sigh, these people that are so afraid of data mining have no idea how much of their lives is mined for information on a daily basis. Just by watching this video someone is learning something about you. Its not something that should freak anyone out, and if it does, well, time to become a hermit!