Stagefright vulnerability leaves 950 million Android devices vulnerable to remote code execution

The operating system has been patched, but it is unclear whether users will receive those patches.

Researchers at mobile security firm

Zimperium

have

discovered

a remote code execution flaw in the

Stagefright

media library used on

Android

phones. The vulnerability allegedly means it could, for instance, take one MMS message for an attacker to run code on a targeted device. In some cases, if the device is old, this code could even be run with elevated system privileges.

Few technical details have been made public so far, but

Zimperium

‘s Joshua J. Drake will present the research at the


Black Hat


and


DEF CON


security events next week.

A

patch

authored by Drake in the

Android

-based

CyanogenMod

operating system suggests the problem lies in a failure to check for edge cases. However, while Drake has published screenshots of him successfully targeting a device running

Android Lollipop 5.1.1

, it isn’t immediately clear how easy it would be for an attacker to turn this into a workable exploit for all, or at least a large portion, of the 950 million vulnerable devices. In the worst case scenario, the exploit could be turned into a worm of a size not seen for a very long time.

The obvious solution to a problem like this is to patch the operating system. Indeed,

Google

patched the operating system within 48 hours of the vulnerability being reported to them. Unfortunately,

Android

users depend on their carriers rolling out patches and those carriers are known to be slow when it comes to delivering patches, if they do so at all.

But perhaps there is a silver lining to this cloud (no pun intended). Perhaps the Internet needs a huge and, apparently, easily exploitable vulnerability like this for carriers to realise that issuing patches to their customers isn’t something they can do as and when it pleases them.

Posted on 28 July 2015 by

Martijn Grooten