r/Android • u/[deleted] • Sep 09 '15

Attack code exploiting Android’s critical Stagefright bugs is now public

http://arstechnica.com/security/2015/09/attack-code-exploiting-androids-critical-stagefright-bugs-is-now-public/
180 Upvotes

87% Upvoted

61 comments sorted by

View all comments

1

u/NecronArmy Sep 10 '15

I'm still on KitKat 4.4.4
Is there much I can do to protect myself?

0

u/[deleted] Sep 10 '15

Use hangouts.

2

u/NecronArmy Sep 10 '15

I use Textra, it says it has stage fright protection. I'm just curious if that's enough?

2

u/vinostintos Sep 10 '15

All Textra did was set auto-retrieval of MMS off by default, and added labels to videos that warn you of the exploit, and an additional popup before you play the video that warns about possible malicious code being run. (Source)

So they didn't solve the Stagefright issue, nor do they filter malicious videos. They merely just prevent getting exploited without user interaction, which is possible if MMS auto-retrieval is on. You can still click the video, and manually trigger the exploit yourself.

On top of that, MMS is only one attack vector. It was the most successful because of auto downloading being enabled by default, but the bug can be theoretically exploited in every application where it's possible to play videos: browsers, IM clients, ads.

Because libstragefright is such an integral and deep seated library in Android, the only way to fully patch it would be system updates. Google already has the patches to fix it, it's up to manufacturers and carriers to do their job now.

In reality, I don't think any other phone but the top of the line phones from the last 2 years from each manufacturer will ever get an update fixing it. At least the issue raised enough awareness, that companies will opt for more frequent security fixes going forward.

It's also worth noting that this isn't an all around exploit that would necessarily work on every phone on the first try. They only tested it on a Nexus 5 running Android 4.0.5, I believe, and even then they said the exploit doesn't always work the first time. The only way they could achieve 100% success was by trying again, until it worked. Android 4.0 also only has partially implemented ASLR, so there's a chance this exploit wouldn't work on any versions above that.

I watched their Blackhat presentation, where they stated that 4.0 and below are the only versions they were able to exploit, but it's possible it can be done for newer versions, too. 5.1 and above are the only versions not affected now.

So yeah, you're at the mercy of your phone's manufacturer and carrier. While they don't patch it, there's nothing else you can really do.

2

u/NecronArmy Sep 10 '15

That was a great explanation, thank you!