Millions of Android Devices Vulnerable To New Stagefright Exploit 48
An anonymous reader writes: Security researchers have found yet another flaw in Android's Stagefright. The researchers were able to remotely hack an Android phone by exploiting the bugs. According to their estimation, the flaw exposes devices running Android software version between 5.0-5.1, or 36% of 1.4 billion, to security attacks. "I would be surprised if multiple professional hacking groups do not have working Stagefright exploits by now. Many devices out there are still vulnerable, so Zimperium has not published the second exploit in order to protect the ecosystem," Zuk Avraham, chairman of Zimperium, the firm which found the first Stagefright exploit told Wired.
Good (Score:5, Funny)
A new nearly-universal root method is always handy.
Re:Good (Score:5, Informative)
That's not what this is. TFP is careful to point out that all it gets you is executing arbitrary code in the process that is affected, in this case the browser. So you would need further exploits to get anywhere from there.
Even that is difficult as it requires knowing certain things about the target device, like the exact ROM it is running. It also looks like Google should be able to mitigate is pretty quickly by updating Chrome and various system components via Play.
Firefox (Score:2)
Didn't Firefox eliminate all usage of stagefright in their browser? That might be safer still, especially considering that Google made this mess. Firefox brings along their own h.264 and webm codecs that can actually be updated - how shockingly innovative!
It might be further prudent to purge any browser based on webkit/blink from Android. The "celebrated" fast browsers (maxthon, cmbrowser) have terrible scores at ssllabs.com anyway.
This is Google's problem with Android:
Re:Good (Score:4, Informative)
Not when there is already an "official" method that requires a physical manipulation.
A typical Android root method that is tolerated by manufacturers requires you to reboot, press a specific button combination, connect your device to a computer via USB and run a program on the computer. This way, you can be reasonably sure that the user is the one why initiated the root procedure and not some malware. Root has serious security implications, so anything that guarantees that it really is the user's choice is a good thing.
Android is not iOS, there is plenty of choice for devices that can be rooted without shady exploits. We shouldn't rejoice when such vulnerabilities appear.
Re: Good (Score:2)
Just for clarification, there are official methods to bootloader unlock some phones (eg Google Nexus, HTC, Motorola, Sony, etc.), but not root. These methods vary by carrier. Generally carrier branded phones may be bootloader unlockable (AT&T HTC One M8/M9/A9) or not (Verizon HTC On M8/M9). Have to do research to figure this one out.
Now with regard to root, root and bootloader unlock often go hand in hand, but they're not the same thing. You can have root on your system without having bootloader unlock
Re: (Score:2)
To expand on that, there are cases when a root exploit is preferable to a bootloader unlock. For example, when the official bootloader unlock procedure deletes all your applications and data, and permanently disables some of the features in your phone. (I'm looking at you, Sony.)
Bad (Score:3)
A new nearly-universal root method is always handy.
To attackers wanting to steal your data, sure.
For users, this is a bad thing. If you want to root your device, buy one that is unlockable and you won't need exploits. Meanwhile, OEMs need to keep their devices patched so that problems like this don't reduce the security of hundreds of millions of devices.
That said, it's worth pointing out that Stagefright appears to have turned out to be much ado about nothing. AFAIK (and I work on the Android security team, so there's a high probability that I would kn
Re: (Score:2)
I am a "user" and the only reason I entered this thread was to see if I could use this to FINALLY root my Galaxy S6 which has a signed bootloader and no root method.
So, you're wrong. Users also want root methods for Android because carriers and manufacturers keep locking the damn bootloader
Re: (Score:2)
Re: (Score:2)
It's really hard to get a phone that has complete freedom and isn't junk. The best compromise I've seen was the HTC m7. I heard the newer Nexus phones might not be as bad as the one I had, but it's going to be a few years before I'm willing to give Google another chance.
Re: (Score:2)
So, you're wrong. Users also want root methods for Android because carriers and manufacturers keep locking the damn bootloader
If you want to root, why did you buy a locked phone? In the short term that's the only way you'll be able to do it reliably. In the long term that's the only way you'll be able to do it at all. As we keep tightening the security model exploits are going to get both rarer and less effective (SELinux is making it damned hard today to convert system exploits to root exploits).
Perhaps more importantly, by choosing to buy an unlockable phone you're sending a message to OEMs, telling them that unlockability is
Re: Bad (Score:2)
We don't all have Carle blanche options on what phones we can buy.
Re: (Score:2)
We don't all have Carte blanche options on what phones we can buy.
Then your days of rooting are coming to an end. They may already have come to an end; it's possible that your Galaxy S6 will never have a workable rooting method.
Re: (Score:2)
because webpages can have built in ads & trackers.
Re: (Score:2)
Re: (Score:1)
Try getting root on Note 4 running android 5.1.1. Can't be done as far as I can tell. :((
Re:FBI will like this. (Score:4, Informative)
Ever notice how the feds never go after Google or the Android phone makers to unlock things? They don't need to, they've been able to go balls-deep in Android since Day One. Too bad only Apple seems to give a poop about security.
It would take me too long to write a full rebuttal for your post, but to summarize: 1) The feds DO go after Google and OEMs to unlock phones. 2) Cheapo Android phones are insecure. But Nexus phones get prompt security updates straight from Google. Samsung is also nowadays rigorous about securing their flagship phones, since they're approved by the DoD for government employee usage (cf. "Samsung Knox").
Re:And? (Score:5, Interesting)
Anyone who in 2016 doesn't understand how the exchange of a "free' phone OS for personal data works needs to grab a refresher from the many excellent sources of economic theory available.
Meanwhile, I *know* I'm the product, but in exchange I get great web searches, kick-ass navigation, YouTube, handy email and calendar integration with work, and more.
Re: (Score:1)
Personal data is a shitty payment option. I have cash. But, not the amount of cash needed to satisfy Google.
Re: (Score:2)
Google? Oh man if you realised how many different companies you need to send your cash to in order to use modern technology you would quickly hide your cash and say "take all my personal data".
I actually think personal data is an awesome payment method. Especially when it's inaccurate and uncontrolled.
Re:And? (Score:4, Insightful)
Anyone who in 2016 doesn't understand how the exchange of a "free' phone OS for personal data works needs to grab a refresher from the many excellent sources of economic theory available.
There's nothing free about Android that is shipped on phones. Vendors deal with Google and in return ship *additional apps* in their OS. The customers then in turn pay very good money for the use of the phone.
All of that is not really an issue anyway since absolutely nothing in Android leaks privacy. You can run it without phoning home, without a Google account, and you can run it even when you have zero access to Google or any Google services (see the millions of Android devices in China).
Mind you I'm interested in your economic theory on open source software, which is what Android actually is.
kick-ass navigation, YouTube, handy email and calendar integration with work, and more.
None of which are part of Android and none of which have anything to do with Android's security implementation.
Missing information from summary (Score:3)
You need to put some basic technical information about what is affected in the summary. If you don't give that, it is just click-baity.
Specifically, this affects Android versions "2.2, 4.0, 5.0 and 5.1. Other versions are not affected."
If you use nerds for editors, that can help make sure that you include the right information in the summary so that users can evaluate if they want to click on the link, or not. We don't just click all the links because they were posted.
Re: (Score:3, Informative)
Well, given that is about 1/3 of all androids in the wild, everyone should be checking.
https://developer.android.com/... [android.com]
Also, other places say all versions of Android 2.2 & above are affected, which is ~95%
http://www.wired.co.uk/news/ar... [wired.co.uk]
2016 The year Linux was like (Score:2)
windows. Sorry Android...
Disabling Auto Download of Multimedia Messages.. (Score:2)
Back when my phone was still reporting it was vulnerable, I took the step of disabling auto downloading of multimedia messages as it was the only way to be sure (Nuke it from Orbit)
I only turned that back on after my phone passed all the known tests... At this point, It's not worth the risk - this whole StageFright thing seems to be just fundamentally bad, so I'm leaving the Auto Download off.
I never once got a multimedia message from someone who wasn't already known to me, but I figure that the slight inco
Re: (Score:2)
I am on a Nexus device, a properly patched Android, but still I removed the MMS configuration from the cellular network AP configurations. I don't use or receive MMS, so there is no need for it. It is another good option.
No problem (Score:2)
Re: (Score:1)
Re: (Score:2)
You wanna know how messed the world is? Let's just say that I'm a pretty content Linux user. My phone is a Windows phone and has been since October of last year. Yup... I use a Windows 8 phone and am pretty happy with it. Actually, I'm more than happy with it. Note: I keep two phones. One is a dumb-phone. I do nothing "secure" or even really private on either phone.
Back in late September, I hit the road. I'm still sort of on it. Some young lady bumped into me and she stuck, she's been there since. At any ra
Apple vs Google (Score:2)
Note the FBI and President aren't publicly pushing for Google's help to unlock Android devices.
Things like this explain why it's not necessary for the government to get help.
What does this mean??? (Score:2)
"This research shows exploitation of this vulnerability is feasible. Even though a universal exploit
with no prior knowledge was not achieved, because it is necessary to build lookup tables per
ROM, it has been proven practical to exploit in the wild."
Especially the part that says "a universal exploit
with no prior knowledge was not achieved".
In other words to own it you must own it? Just kidding, excellent work .
I'm safe (Score:4, Informative)
From the PDF: "The victim also has to linger for a time in the attack webpage"
Since I don't use my phone for browsing*, I guess I'm safe for the moment.
-
*Yeah, I just use it to make calls and take calls, and maybe snap the occasional picture. Weird, huh?