Posted by Virus Bulletin on Jul 28, 2015
The operating system has been patched, but it is unclear whether users will receive those patches.
Researchers at mobile security firm Zimperium have discovered a remote code execution flaw in the Stagefright media library used on Android phones. The vulnerability allegedly means it could, for instance, take one MMS message for an attacker to run code on a targeted device. In some cases, if the device is old, this code could even be run with elevated system privileges.
Few technical details have been made public so far, but Zimperium's Joshua J. Drake will present the research at the Black Hat and DEF CON security events next week.
A patch authored by Drake in the Android-based CyanogenMod operating system suggests the problem lies in a failure to check for edge cases. However, while Drake has published screenshots of him successfully targeting a device running Android Lollipop 5.1.1, it isn't immediately clear how easy it would be for an attacker to turn this into a workable exploit for all, or at least a large portion, of the 950 million vulnerable devices. In the worst case scenario, the exploit could be turned into a worm of a size not seen for a very long time.
The obvious solution to a problem like this is to patch the operating system. Indeed, Google patched the operating system within 48 hours of the vulnerability being reported to them. Unfortunately, Android users depend on their carriers rolling out patches and those carriers are known to be slow when it comes to delivering patches, if they do so at all.
But perhaps there is a silver lining to this cloud (no pun intended). Perhaps the Internet needs a huge and, apparently, easily exploitable vulnerability like this for carriers to realise that issuing patches to their customers isn't something they can do as and when it pleases them.
Posted on 28 July 2015 by Martijn Grooten
