Stagefright vulnerability leaves 950 million Android devices vulnerable to remote code execution

Posted by   Virus Bulletin on   Jul 28, 2015

The operating system has been patched, but it is unclear whether users will receive those patches.

Researchers at mobile security firm Zimperium have discovered a remote code execution flaw in the Stagefright media library used on Android phones. The vulnerability allegedly means it could, for instance, take one MMS message for an attacker to run code on a targeted device. In some cases, if the device is old, this code could even be run with elevated system privileges.

Few technical details have been made public so far, but Zimperium's Joshua J. Drake will present the research at the Black Hat and DEF CON security events next week.

A patch authored by Drake in the Android-based CyanogenMod operating system suggests the problem lies in a failure to check for edge cases. However, while Drake has published screenshots of him successfully targeting a device running Android Lollipop 5.1.1, it isn't immediately clear how easy it would be for an attacker to turn this into a workable exploit for all, or at least a large portion, of the 950 million vulnerable devices. In the worst case scenario, the exploit could be turned into a worm of a size not seen for a very long time.

The obvious solution to a problem like this is to patch the operating system. Indeed, Google patched the operating system within 48 hours of the vulnerability being reported to them. Unfortunately, Android users depend on their carriers rolling out patches and those carriers are known to be slow when it comes to delivering patches, if they do so at all.

But perhaps there is a silver lining to this cloud (no pun intended). Perhaps the Internet needs a huge and, apparently, easily exploitable vulnerability like this for carriers to realise that issuing patches to their customers isn't something they can do as and when it pleases them.

Posted on 28 July 2015 by Martijn Grooten

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Test your technical and mental limits in the VB2017 foosball tournament

As has become tradition, VB2017 will once again see a security industry table football tournament. Register your team now for some great fun and adrenaline-filled matches in between sessions in Madrid!

The case against running Windows XP is more subtle than we think it is

Greater Manchester Police is one of many organizations still running Windows XP on some of its systems. This is bad practice, but the case against running XP is far more subtle than we often pretend it is.

Hot FinSpy research completes VB2017 programme

Researchers from ESET have found a new way in which the FinSpy/FinFisher 'government spyware' can infect users, details of which they will present at VB2017 in Madrid.

Transparency is essential when monitoring your users' activities

Activity monitoring by security products in general, and HTTPS traffic inspection in particular, are sensitive issues in the security community. There is a time and a place for them, VB's Martijn Grooten argues, but only when they are done right.

VB2017 preview: Android reverse engineering tools: not the usual suspects

We preview the VB2017 paper by Fortinet researcher Axelle Apvrille, in which she looks at some less obvious tools for reverse engineering Android malware.