Android Stagefright Saga
95 percent of all Android smartphones can be attacked. I wish I could start this article more positively but that is the mother of all TL;DR’s for something considered by many security experts as “the mother of all Android vulnerabilities”.
[quote style=’1′ cite=” title=”]Almost all devices running any version below Android 4.1 are vulnerable to exploitation.[/quote]
Through a series of weaknesses in the Stagefright multimedia interface the attacker would only need to send an MMS or Hangouts message in which is exploit code for their victim-to-be.
[image src=’http://fnx.network/fnxnetwork/wp-content/uploads/2015/07/7172221241_ba8c8092a2_m.jpg’ width=’240′ height=’165′ title=’Source: Philippe Put, Flickr’ align=’right’]In order for the exploit to start it’s processes, the victim in some cases does not even need to open the message. The code is executed when the message is processed by the Android OS. Part of that code is to delete the message when complete so it’s a murder without a hair, fingerprint or even the idea that anything has happened.
What can be accessed by the attack code depends on what rights and permissions the tainted process is running. By default, the attacker can break through the Stagefright mediums; so audio recordings and videos, and gain access to the Media Gallery and the Bluetooth interface. The code can also try to get higher permissions and does so through masking as well as just the old fashioned ‘prompt the user for permission’ window. Some older devices like the Samsung Galaxy S4 however, trying to gain higher permission is not necessary as the affected process is already running with system privileges.
[image src=’http://fnx.network/fnxnetwork/wp-content/uploads/2015/07/15456394426_0c8ec58465_m.jpg’ width=’240′ height=’160′ title=’Source: Va Gueonthehow, Flickr’ align=’left’]So as you clasp your droid in your hands, probably in Airplane mode at this point, you are asking the question – Which devices are affected?
The answer. Almost all devices running any version below Android 4.1 are vulnerable to exploitation.
Manufacturers are now busy making patches for the exploits, however like all vendor-based solutions it is not known how long it will be before it reaches potential victim phones. Newer versions of Android after 4.1 are equipped with protection functions that make it difficult to exploit via MMS. But the gaps in Stagefright framework exploit can be abused for attacks so until there is a larger patch, no one can really consider themselves safe.
The developers of alternative Android distribution CyanogenMod declare that they have closed the gaps the nightly build of 12.1. A secure version 11 is to follow this weekend.