As per reports, the security research found a flaw in HTC smartphones running Windows Mobile 6 or Windows Mobile 6.1 that allows hackers to access any file on the phone or upload malicious code using Bluetooth. 

Alberto Moreno Tablado Security Researcher said giving warning that “HTC devices running Windows Mobile 6 and Windows Mobile 6.1 are prone to a directory traversal vulnerability in the Bluetooth OBEX FTP Service”. 

The security researcher also said that HTC handsets running Windows Mobile 5 are not affected. For the attack to work, the targeted device must have Bluetooth enabled and file sharing over Bluetooth activated. 

Referring to a process where the attacking device attempts to convince the target that it's another device on its list of paired devices, Tablado said, “This connection can be done either by standard Bluetooth pairing or taking advantage of the Bluetooth MAC spoofing attack”. 

Moreover, it also allows the attacker to move from a phone's Bluetooth shared folder into other folders, giving them access to contact details, emails, pictures or other data stored on the phone due to the problem in the directory traversal. Even they can utilize the access to read files or upload software, including malicious code. 

The best solution to this is to avoid pairing your phones with an untrusted handset or computer. He said they may also want to delete any devices that are already paired with their phones. 

Moreno Tablado tested the vulnerability on a range of HTC handsets, including the Touch Diamond, Touch Pro, Touch Cruise, Touch Find, S710 and S740, among others and said that, “It seems that HTC includes this driver, which is vulnerable, in all the devices running Windows Mobile 6 and Windows Mobile 6.1, as a part of the Bluetooth stack”. 

Moreno Tablado said that, "I am forced to go public with all the information because HTC showed no intention to release a security fix”. His blog provides detailed information about the vulnerability. 

He also said that, "I guess that all forthcoming Windows Mobile 6.5 devices will be vulnerable too if HTC does not fix the driver.”

Related News:
HTC introduces new key feature ‘Inner Circle’ on HTC Snap
HTC & SMAR launch HTC Magic in Philippines
HTC launches Touch Pro2 with new Straight Talk Technology
HTC launches new flagship device ‘HTC Touch Pro2’ in Malaysia

Related Books:
Mobile Trek
Mobile Computing
Mobile Distance 

Add a comment

Posted by Naresh Koshti on 18 July, 2009 11:19:38 AM IST #