Slashdot Mirror
Zimperium Releases Stagefright Detection Tool and Vulnerability Demo Video
Mark Wilson writes: We've already looked at the Stagefright vulnerability, discovered by Zimperium, and shown what can be done to deal with it. Affecting up to 95 percent of Android devices, the vulnerability has led to Google and Samsung announcing monthly security updates. Now the mobile security company has released additional details about how the exploit works. To help explain the vulnerability, a video has been produced which uses a Stagefright demonstration to illustrate it in action. Zimperium has also released an Android app that checks devices for the vulnerability.
Okay then.
Maybe Dice can get on FristPost/GNAA Detection Tool? Nah...that would require programming talent.
Left MS Windows for Linux Mint and never looked back!
Vote for Bernie in 2016!
A security vulnerability discussion on Slashdot that's over 30 minutes old and has no posts relevant to the content (including this one), and instead has three trolls, one reaction to a troll, and one comment on the fall of Slashdot.
I really did not expect to see this.
Do not look into laser with remaining eye.
Well, on my Transformer Prime, anyway. The unlock tool doesn't work on it, so I have quite an uphill battle ahead of me upgrading it...
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I predict SDTs will spread like wildfire through the live performance community. Exciting news for understudies everywhere!
From what I understand, Stagefright is a bug that can only be removed in one of two ways: either by an update from the manufacturer of your device, or rooting your device and manually removing the image viewer that Stagefright uses as a vector. There's really nothing an average (non-rooting) user can do to fix their devices but wait, and nothing they can really do to stop it happening to them short of turning their device off completely and preventing it from getting texts. Sure, it'll tell them that their device is vulnerable, but it's a case of "You're vulnerable to Stagefright and can do absolutely nothing about it short of rooting your device until your device manufacturer decides to release an update."
>Google and Samsung announcing monthly security updates
I call bullshit.
until they take security seriously (which means backporting fixes to old os's in phones) this is worse then bullshit. its acting like a real fix when, in fact, its stil business as usual. phones will not get updates if the vendor wants to force you to re-re-rebuy yet another phone.
when there is a push to keep selling you things that you already have, you will NOT get software updates or support.
the model is broken by design. apple has it mostly right (although they also actively try to force upgrades on hardware by EOLing perfectly good and working hw) but android/google fucked the chicken, here. they decided to make a monolithic system out of the non-monolithic linux base and there's no fixing this broken-by-design idea. vendors are enjoying their wild-west view of things and anything goes! consumer protection is a thing that we used to have 20+ yrs ago, but no one cares about us anymore.
looking to google to help secure things? HA! samsung? DOUBLE HA!
both are jokes when it comes to software QUALITY. such a shame, too, that such rich companies don't give time or energy to things that truly are important to users.
--
"It is now safe to switch off your computer."
I'm not saying they should have done it, because of legal exposure, but...
It would have been pretty cool if the Stagefright detection app, also used the vulnerability to patch your system in some way.
I wonder how that would have been received, if it had all worked perfectly and not screwed something up.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Using a 2 year old NEC Android phone which is totally locked down with no way to update it myseld. =(
And NEC has not provided a single update once.....
Google should provide a tool which would allow users to update their phones themselves instead for having to wait for the manufacturer to do something if those ba$tard$ are willing to do anything at all....
I'm not going to install a tool to see if I have a vulnerability, which could potentially cause some douche nozzle to get root on my phone. No thanks. I'd rather take my chances. I'll do a factory reset after the patch is available for my phone anyways.
Finally, a first post that makes some sense.
Sleep your way to a whiter smile...date a dentist!
I for once welcome the end of the Google's rolling releases stupidity.
Finally, Android is getting the security updates, as any other mature OS did for literally decades now.
All hope abandon ye who enter here.
What the title says. Thanks, I'll pass!
My texting app, Textra, updated last weekend with builtin Stagefright protection.
Looking at the demonstration video, it appears that it is very easy to root the phone. Much easier than more "traditional" rooting techniques with boot loaders and ROMS, which are more trouble than I care to go through, especially if it's going to break Knox and my warranty switch.
How can I use this vulnerability to gain root for myself?
On a stock, non-rooted phone you can disable MMS to provide some degree of protection from this particular exploit.
Although unconfirmed, there are several stagefright booleans in /system/build.prop on some phones. Setting them to false might provide some additional protection. Root and a reasonable text editor will be required (i.e., busybox vi), and you should be able to recover from a boot loop before attempting this modification.