Slashdot Mirror

← Back to Stories (view on slashdot.org)

950 Million Android Phones Can Be Hijacked By Malicious Text Messages

Posted by samzenpus on from the protect-ya-neck dept.

techtech writes: According to security firm Zimperium a flaw called "Stagefright" in Google's Android operating system can allow hackers take over a phone with a message even if the user doesn't open it. The vulnerability affects about 950 million Android devices. In a blog post Zimperium researchers wrote: "A fully weaponized successful attack could even delete the message before you see it. You will only see the notification. These vulnerabilities are extremely dangerous because they do not require that the victim take any action to be exploited. Unlike spear-phishing, where the victim needs to open a PDF file or a link sent by the attacker, this vulnerability can be triggered while you sleep. Before you wake up, the attacker will remove any signs of the device being compromised and you will continue your day as usual—with a trojaned phone."

5 of 120 comments (clear)

  1. idiots by bws111 · · Score: 5, Informative

    Hey morons, you already posted this TODAY.

  2. ..all versions of Android after and including 2.2 by OutOnARock · · Score: 5, Insightful

    95% of them will never be patched........thanks for all the fragmentation.....

  3. MMS vector by xarragon · · Score: 5, Informative

    TFA (requires obnoxious CAPTCHA just to read, wtf) makes it clear the payload is inside a media file attached to an MMS. Myself I do not use MMS since it seems to require OTA data to download the MMS payload, which is exceedingly expensive on my current prepaid plan. Old phones are pretty likely to be used like this; voice only, data only over wifi, so it might lessen the impact. Anyways, I am on Lollipop.

  4. Re:..all versions of Android after and including 2 by ZorinLynx · · Score: 5, Insightful

    It's the phone makers' faults. Sorry, but that's just the way it is.

    Apple has shown that it's possible for the device manufacturer to deploy new software directly. Yet in the Android world, it's still the carriers doing it. There's only a few phones where the manufacturer pushes new updates (and even those don't tend to be supported as long as iPhones do)

    The Android world needs to wake the hell up and start supporting its users properly. It's ridiculous that this sort of situation can happen; if a similar exploit appeared for iOS, Apple would patch devices in 10 seconds flat.

  5. Rooting is over-rated by aNonnyMouseCowered · · Score: 5, Informative

    "It can only be fixed by a rooted device or a software update to replace the broken library."

    "Rooting" (or allowing runtime access to root-level functions) is unnecessary for fixing any Android OS-level problem. However an unlocked bootloader will allow you to install an unofficial update or patch (unfortunately also allowing you to install a malware). A "rooted" device is actually even more of a security risk, especially if you have to trust a closed-sourced "superuser" binary.

    Note that I distinguish between "rooted" Android systems that allow you to gain root level access on demand and those setups that allow for off-line root access via special recovery or debug modes that require a reboot and so is not available when running the system normally.