HTC settles with FTC over security issues in tablets, smartphones

HTC must release patches to fix vulnerabilities in its mobile software
  • Nancy Weil (IDG News Service)
  • — 22 February, 2013 18:59

The U.S. Federal Trade Commission has reached a settlement with HTC America over security holes in the company's smartphone and tablet software that left millions of users' personal information at risk.

Under the terms of the agreement, HTC must release software patches to fix the vulnerabilities and develop a "comprehensive security program designed to address security risks during the development of HTC devices." The company must also submit to independent security assessments every other year for the next 20 years, the FTC said in a statement Friday. The company is sending security updates to customers, who are urged to apply them as soon as possible, the FTC said.

The FTC had charged that the company failed to use reasonable and appropriate security practices for design and customization of software on its smartphones and tablets. "HTC America failed to provide its engineering staff with adequate security training, failed to review or test the software on its mobile devices for potential security vulnerabilities, failed to follow well-known and commonly accepted secure coding practices, and failed to establish a process for receiving and addressing vulnerability reports from third parties," the FTC charged.

The commission's complaint against FTC noted multiple vulnerabilities found on HTC devices, including insecure implementation of the logging applications Carrier IQ and HTC Loggers, along with programming flaws that could let third-party applications bypass Android's permission-based security. Millions of HTC device users were potentially vulnerable to malicious applications that could send texts, record audio, or install malware on their devices, the FTC said.

User manuals for HTC Android-based devices "contained deceptive representations" and the user interface for the Tell HTC application was also deceptive, the FTC alleged.

HTC is prohibited from making false or misleading statements about security and privacy of users' data on its devices, the FTC said.

HTC's public relations agency did not immediately provide comment from the company regarding the settlement agreement.

Tags: U.S. Federal Trade Commission, regulation, legal, Civil lawsuits, hardware systems, smartphones, tablets, HTC America, government, htc, consumer electronics, security

BlackBerry Hints at Complete End Point Security

READ THIS ARTICLE
DO NOT SHOW THIS BOX AGAIN [ x ]
Comments are now closed.
CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Cloud Trust Authority

Reduce complexity and increase trust for public cloud service providers and their customers.

Latest Jobs
Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.