HTC Settles FTC Charges It Failed to Patch Vulnerabilities On Smartphones and Tablets Shipped to Consumers
HTC America has agreed to settle Federal Trade Commission (FTC) charges that the company failed to secure the software it developed for its smartphones and tablet computers, introducing security flaws that placed consumers' information at risk.
The settlement requires HTC America to develop and release software patches to fix vulnerabilities found in millions of HTC devices. In addition, the settlement requires HTC America to establish a security program designed to address security risks during the development of HTC devices and to undergo independent security assessments every other year for the next 20 years.
HTC America, Inc. develops and manufactures mobile devices based on the Android, Windows Mobile, and Windows Phone operating systems. The company has customized the software on these devices in order to differentiate itself from competitors and to comply with the requirements of mobile network operators.
The FTC charged that HTC America failed to employ reasonable and appropriate security practices in the design and customization of the software on its mobile devices. Among other things, the complaint alleged that HTC America failed to provide its engineering staff with adequate security training, failed to review or test the software on its mobile devices for potential security vulnerabilities, failed to follow well-known and commonly accepted secure coding practices, and failed to establish a process for receiving and addressing vulnerability reports from third parties.
The FTC's complaint details several vulnerabilities found on HTC's devices, including the insecure implementation of two logging applications - Carrier IQ and HTC Loggers - as well as programming flaws that would allow third-party applications to bypass Android's permission-based security model.
Due to these vulnerabilities, the FTC charged, millions of HTC devices compromised sensitive device functionality, potentially permitting malicious applications to send text messages, record audio, and even install additional malware onto a consumer's device, all without the user?s knowledge or consent.
Moreover, the complaint alleged that the user manuals for HTC Android-based devices contained deceptive representations, and that the user interface for the company's Tell HTC application was also deceptive. In both cases, the security vulnerabilities in HTC Android-based devices undermined consent mechanisms that would have otherwise prevented unauthorized access or transmission of sensitive information.
The settlement also prohibits HTC America from making any false or misleading statements about the security and privacy of consumers' data on HTC devices. HTC America and its network operator partners are also in the process of deploying the security patches required by the settlement to consumers? devices.
HTC America, Inc. develops and manufactures mobile devices based on the Android, Windows Mobile, and Windows Phone operating systems. The company has customized the software on these devices in order to differentiate itself from competitors and to comply with the requirements of mobile network operators.
The FTC charged that HTC America failed to employ reasonable and appropriate security practices in the design and customization of the software on its mobile devices. Among other things, the complaint alleged that HTC America failed to provide its engineering staff with adequate security training, failed to review or test the software on its mobile devices for potential security vulnerabilities, failed to follow well-known and commonly accepted secure coding practices, and failed to establish a process for receiving and addressing vulnerability reports from third parties.
The FTC's complaint details several vulnerabilities found on HTC's devices, including the insecure implementation of two logging applications - Carrier IQ and HTC Loggers - as well as programming flaws that would allow third-party applications to bypass Android's permission-based security model.
Due to these vulnerabilities, the FTC charged, millions of HTC devices compromised sensitive device functionality, potentially permitting malicious applications to send text messages, record audio, and even install additional malware onto a consumer's device, all without the user?s knowledge or consent.
Moreover, the complaint alleged that the user manuals for HTC Android-based devices contained deceptive representations, and that the user interface for the company's Tell HTC application was also deceptive. In both cases, the security vulnerabilities in HTC Android-based devices undermined consent mechanisms that would have otherwise prevented unauthorized access or transmission of sensitive information.
The settlement also prohibits HTC America from making any false or misleading statements about the security and privacy of consumers' data on HTC devices. HTC America and its network operator partners are also in the process of deploying the security patches required by the settlement to consumers? devices.
