Stagefright vulnerability leaves 950 million Android devices vulnerable to remote code execution

Posted by   Virus Bulletin on   Jul 28, 2015

The operating system has been patched, but it is unclear whether users will receive those patches.

Researchers at mobile security firm Zimperium have discovered a remote code execution flaw in the Stagefright media library used on Android phones. The vulnerability allegedly means it could, for instance, take one MMS message for an attacker to run code on a targeted device. In some cases, if the device is old, this code could even be run with elevated system privileges.

Few technical details have been made public so far, but Zimperium's Joshua J. Drake will present the research at the Black Hat and DEF CON security events next week.

A patch authored by Drake in the Android-based CyanogenMod operating system suggests the problem lies in a failure to check for edge cases. However, while Drake has published screenshots of him successfully targeting a device running Android Lollipop 5.1.1, it isn't immediately clear how easy it would be for an attacker to turn this into a workable exploit for all, or at least a large portion, of the 950 million vulnerable devices. In the worst case scenario, the exploit could be turned into a worm of a size not seen for a very long time.

The obvious solution to a problem like this is to patch the operating system. Indeed, Google patched the operating system within 48 hours of the vulnerability being reported to them. Unfortunately, Android users depend on their carriers rolling out patches and those carriers are known to be slow when it comes to delivering patches, if they do so at all.

But perhaps there is a silver lining to this cloud (no pun intended). Perhaps the Internet needs a huge and, apparently, easily exploitable vulnerability like this for carriers to realise that issuing patches to their customers isn't something they can do as and when it pleases them.

Posted on 28 July 2015 by Martijn Grooten

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

VB2017 call for last-minute papers opened

Today, we open the call for last-minute papers for VB2017. Submit before 3 September to have your abstract considered for one of the ten slots reserved for 'hot' research.

Five reasons to come to VB2017 in Madrid

We're not ones to make bold claims about our conference, and we suggest you ask past attendees for their opinion, but here are five reasons why we think you should come to VB2017 in Madrid.

DMARC: an imperfect solution that can make a big difference

US Senator Ron Wyden has asked the Department of Homeland Security to implement DMARC. Martijn Grooten looks at what difference this could make for phishing attacks impersonating the US federal governent.

Advanced and inept persistent threats to be discussed at VB2017

Unsurprisingly given today's threat landscape, the VB2017 programme contains several talks on various advanced persistent threats - but also a talk on what may be the polar opposite of such threats: an inept persistent threat.

Password security is 1% choosing a half-decent password, 99% not using it anywhere else

Password security advice focuses too much on password strength and too little on avoiding password reuse, Martijn Grooten argues.