Randy Abrams, via his Security Through Absurdity blog, discusses the chilling permissions problem he uncovered on his T-Mobile / HTC supplied Android device. It seems a demo of the seemingly innocuous Bejeweled game from Electronic Arts is preinstalled on the device with a range of permissions typically reserved for spyware type applications. Concerning permissions include the ability to:
- Read and write contact data
- Send SMS messages
- Receive SMS messages
- Determine Course and GPS location
- Record audio
According to Randy, these extensive permissions aren't a part of the paid version of Bejeweled. In response to Randy's inquiries into the invasive permission problem, EA Games has put the blame on HTC, who in turn has put the blame on T-Mobile. Currently there is no removal option and apparently attempting to remove the demo game manually may void the warranty on the device.
If you own or are considering a purchase of a T-Mobile HTC device, I strongly encourage a read of Randy's excellent discussion of the problem: The Mysterious Permissions of Bejeweled 2.