Slashdot Mirror
950 Million Android Phones Can Be Hijacked By Malicious Text Messages
techtech writes: According to security firm Zimperium a flaw called "Stagefright" in Google's Android operating system can allow hackers take over a phone with a message even if the user doesn't open it. The vulnerability affects about 950 million Android devices. In a blog post Zimperium researchers wrote: "A fully weaponized successful attack could even delete the message before you see it. You will only see the notification. These vulnerabilities are extremely dangerous because they do not require that the victim take any action to be exploited. Unlike spear-phishing, where the victim needs to open a PDF file or a link sent by the attacker, this vulnerability can be triggered while you sleep. Before you wake up, the attacker will remove any signs of the device being compromised and you will continue your day as usual—with a trojaned phone."
Hey morons, you already posted this TODAY.
CM and nearly all custom roms are immune and Lollipop is completely unaffected. Next time don't buy a carrier device.
$
EXCEPT 5.0 Lollipop, because Lollipop uses a different media framework. Which I'm sure has its own issues, but thankfully, even a year after release, its marketshare is tiny enough that it doesn't matter.
Even worse, it's a bug inside the OS itself, so it's not like Google can actually fix the problem like they have using Google Services Framework.
It can only be fixed by a rooted device or a software update to replace the broken library.
TFA (requires obnoxious CAPTCHA just to read, wtf) makes it clear the payload is inside a media file attached to an MMS. Myself I do not use MMS since it seems to require OTA data to download the MMS payload, which is exceedingly expensive on my current prepaid plan. Old phones are pretty likely to be used like this; voice only, data only over wifi, so it might lessen the impact. Anyways, I am on Lollipop.
"It can only be fixed by a rooted device or a software update to replace the broken library."
"Rooting" (or allowing runtime access to root-level functions) is unnecessary for fixing any Android OS-level problem. However an unlocked bootloader will allow you to install an unofficial update or patch (unfortunately also allowing you to install a malware). A "rooted" device is actually even more of a security risk, especially if you have to trust a closed-sourced "superuser" binary.
Note that I distinguish between "rooted" Android systems that allow you to gain root level access on demand and those setups that allow for off-line root access via special recovery or debug modes that require a reboot and so is not available when running the system normally.
That is completely wrong. The blog post by the folks who discovered the vulnerability even includes screencaps of Lollipop 5.1.1 being taken over via MMS. Not sure where you got the idea that Lollipop and CM are unaffected.
Concerning CyanogenMod, this was posted to their Facebook page a few hours ago:
Recent Stagefright issues
The following CVE's have been patched in CM12.0 and 12.1 nightlies for a couple weeks. If you haven't updated already, we strongly encourage you to do so.
CM11 will see these updates hit as part of out of band fixes this weekend (these releases occur weekly).
CVE-2015-1538
CVE-2015-1539
CVE-2015-3824
CVE-2015-3826
CVE-2015-3827
CVE-2015-3828
CVE-2015-3829
We are actively following all the DefCon events and announcements and will be keeping tabs on other disclosures that could impact CM and its derivatives.
ï