I have an HTC that is vulnerable to USSD attack. I am trying to tell the HTC helpdesk about this issue, but they tell me that unless there is an official news from android team about this, they will ignore the huge amount of articles from blogs and websites that talk about this. There is any official android article about this that I can link to them?
That's dangerously ignorant. I just checked today with a trustworthy site, and indeed, my Milestone² was affected as well. The source is known to be the stock dialer, so HTC phones are affected as well (at least unless they're running Jelly Bean already). I'd tell them to please give this statement in written form on company paper (with the HTC header), so you can go with that to some boulevard press to have it printed in the daily news. Maybe it's more convincing to them to read the fact there than in known reputable sources.
Meanwhile, the main issue is to get yourself protected. I recommend to install NoTelURL, which in its latest version runs on all Android versions from 2.0.1 up. I can vouch for the developer as a trusted person: he's a member of the AndroidPIT community with high reputation. Having this app installed, all USSD actions triggered by an app will open a pop-up to select the app the action should be performed with: the dialer (which was the only one registered for this before) or NoTelUrl. Then you can decide: Select the dialer to really execute, or simply press the "back" button. Just don't make anything the default here ;)