If you have an HTC smartphone running Windows Mobile 6 or Windows Mobile 6.1, you may want to think twice before connecting to an untrusted device using Bluetooth. Vulnerability in an HTC driver installed on these phones can allow an attacker to access any file on the phone or upload malicious code using Bluetooth. HTC handsets running Windows Mobile 5 are not affected.
For the attack to work, the targeted device must have Bluetooth enabled and file sharing over Bluetooth activated. This connection can be done either by standard Bluetooth pairing or taking advantage of the Bluetooth MAC spoofing attack, a process where the attacking device attempts to convince the target that it’s another device on its list of paired devices.
The directory traversal vulnerability allows an attacker to move from a phone’s Bluetooth shared folder into other folders, giving them access to contact details, e-mails, pictures or other data stored on the phone. They can use this access to read files or upload software, including malicious code.
What can you do to prevent this from ever happening? DO NOT accept untrusted Bluetooth connection. Disable file-sharing over Bluetooth for that extra layer of security. You’ll also want to delete your list of previously paired devices, as nefarious hackers can masquerade as a trusted device in order to gain access to your phone.
It’s unclear if HTC will issue an updated Bluetooth driver.
Bluetooth vulnerability found in HTC Windows Mobile smartphones via IntoMobile.