Slashdot Mirror
950 Million Android Phones Can Be Hijacked By Malicious Text Messages
techtech writes: According to security firm Zimperium a flaw called "Stagefright" in Google's Android operating system can allow hackers take over a phone with a message even if the user doesn't open it. The vulnerability affects about 950 million Android devices. In a blog post Zimperium researchers wrote: "A fully weaponized successful attack could even delete the message before you see it. You will only see the notification. These vulnerabilities are extremely dangerous because they do not require that the victim take any action to be exploited. Unlike spear-phishing, where the victim needs to open a PDF file or a link sent by the attacker, this vulnerability can be triggered while you sleep. Before you wake up, the attacker will remove any signs of the device being compromised and you will continue your day as usual—with a trojaned phone."
Hey morons, you already posted this TODAY.
95% of them will never be patched........thanks for all the fragmentation.....
EXCEPT 5.0 Lollipop, because Lollipop uses a different media framework. Which I'm sure has its own issues, but thankfully, even a year after release, its marketshare is tiny enough that it doesn't matter.
Even worse, it's a bug inside the OS itself, so it's not like Google can actually fix the problem like they have using Google Services Framework.
It can only be fixed by a rooted device or a software update to replace the broken library.
You can blame the carriers for much of that fragmentation.
Finger pointing.
The time-worn bullshit excuse that obviously never gets old.
If at first you don't succeed, fucking blame someone else.
"If you never use any computer you're even safer. I suggest you throw out the one you typed this on."
I'd think his public library would be upset by that.
"National Security is the chief cause of national insecurity." - Celine's First Law
TFA (requires obnoxious CAPTCHA just to read, wtf) makes it clear the payload is inside a media file attached to an MMS. Myself I do not use MMS since it seems to require OTA data to download the MMS payload, which is exceedingly expensive on my current prepaid plan. Old phones are pretty likely to be used like this; voice only, data only over wifi, so it might lessen the impact. Anyways, I am on Lollipop.
It's the phone makers' faults. Sorry, but that's just the way it is.
Apple has shown that it's possible for the device manufacturer to deploy new software directly. Yet in the Android world, it's still the carriers doing it. There's only a few phones where the manufacturer pushes new updates (and even those don't tend to be supported as long as iPhones do)
The Android world needs to wake the hell up and start supporting its users properly. It's ridiculous that this sort of situation can happen; if a similar exploit appeared for iOS, Apple would patch devices in 10 seconds flat.
"It can only be fixed by a rooted device or a software update to replace the broken library."
"Rooting" (or allowing runtime access to root-level functions) is unnecessary for fixing any Android OS-level problem. However an unlocked bootloader will allow you to install an unofficial update or patch (unfortunately also allowing you to install a malware). A "rooted" device is actually even more of a security risk, especially if you have to trust a closed-sourced "superuser" binary.
Note that I distinguish between "rooted" Android systems that allow you to gain root level access on demand and those setups that allow for off-line root access via special recovery or debug modes that require a reboot and so is not available when running the system normally.
And this is why I use a $9 phone that has support for nothing other than voice calls and plaintext SMS. Not only is it free from the effects of such exploits but the battery also lasts two weeks between charges, it fits very nicely in even the smallest pocket and doesn't distract me when I should be working or spending time with friends and family.
You insensitive fucking clod, my wife read that, got all excited, and left me. Said something about wanting to have your babies. You must get that a lot though.
Slashdot kooks are getting like that crazy uncle who brags about not having email. Or a computer.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
That is completely wrong. The blog post by the folks who discovered the vulnerability even includes screencaps of Lollipop 5.1.1 being taken over via MMS. Not sure where you got the idea that Lollipop and CM are unaffected.
or never configure it in the first place to work.
that's your fix.
and slashdot editors: MMS IS NOT SMS SO FUCK YOU SLASHDOT EDITOR. it's not even remotely same technlogy.
mms is vulnurable? duh. how about sharing the image preview vuln(presumably) that's actually used since that has much more to it than just mms. but that mms implementation is exploitable is quite a bit less fatal/interesting than sms vuln.
besides than that I'm pretty fucking sure that 950 million android phones (total androids out there) don't have preview of mms in the notifications bar. only a subset has that feature. but the more interesting and potentially attackable route is through anything else that shows images.
world was created 5 seconds before this post as it is.
Coming from an android user, the gp is absolutely correct. Allowing carriers to decide whether updates are pushed out simply means that they never do so. It's the top item on the [fairly short] list of things that I wish would be copied from Apple.
Concerning CyanogenMod, this was posted to their Facebook page a few hours ago:
Recent Stagefright issues
The following CVE's have been patched in CM12.0 and 12.1 nightlies for a couple weeks. If you haven't updated already, we strongly encourage you to do so.
CM11 will see these updates hit as part of out of band fixes this weekend (these releases occur weekly).
CVE-2015-1538
CVE-2015-1539
CVE-2015-3824
CVE-2015-3826
CVE-2015-3827
CVE-2015-3828
CVE-2015-3829
We are actively following all the DefCon events and announcements and will be keeping tabs on other disclosures that could impact CM and its derivatives.
ï
Actually you could just disable auto-fetching of media within MMS to work around the problem.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
"According to security firm Zimperium a flaw called "Stagefright" in Google's Android operating system"
Um, the flaw isn't called stagefright - the flaw is in a component called stagefright!
retrorocket.o not found, launch anyway?
What are you talking about? What does being in Canada have to do with it? I have rooted, unlocked, and installed CM on several devices including my Virgin Mobile Galaxy S1 and a Kudo Galaxy S2. And all the carriers here allow you to bring your own device if you wish. I brought my unlocked S2 to Telus.
When the critical Samsung keyboard exploit hit the news, I was able to do this (and you were not):
mount -o remount,rw /system /system/app . /system
cd
mv SamsungIME.apk SamsungIME.banished
scp cyanogen:/tmp/LatinIME.apk
cd
mount -o remount,ro
reboot
I have no intention of relinquishing my ability to repair this vendor-inflicted brain damage because of your foolish misconceptions.
As usual, I prefer to blame the victims (us).
On a desktop personal computer, it would never occur to you to think "Oh, I just assume I'll get software maintenance from my ISP," and if anyone ever actually said that then you would point your finger at them and laugh and their over-the-top stupidity.
But change the form factor of the personal computer to handheld and suddenly we don't do the pointing and laughing. On the very face of it, it's JUST AS STUPID. So WTF?
Users are not exercising their common sense. They simply aren't. You can make excuses for not using common sense and explain why we did this very obviously stupid thing, but don't pretend it's not happening. Every morning you're getting up and putting a "kick me" sign on your back. You know that you're doing it and you know what consequences will invariably flow from it.
"I don't have any other signs to put on my back! All the signs on the market say 'kick me!'"
"Just because I wear a 'kick me' sign that doesn't mean anyone really has license to kick me! They shouldn't be doing that to me!"
Ok, go on and say those things. You even have some valid points, and the things you're saying might even be technically correct. But that doesn't mean you don't sound stupid, because you don't have not getting kicked in your requirements! WTF, people?!
Stop thinking of handhelds as some weird special case where ALL your experiences with software maintenance magically don't apply! THAT'S STUPID! So yeah, I'm a victim-blamer. You know when you buy your PC from your ISP or from a manufacturer who has a history of preventing maintenance, what's going to happen. And when people pretend they don't know the invariable consequences of buying PCs from ISPs, the stupidity takes on a flavor of dishonesty. Mmmm, yum!
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.