Slashdot Mirror
Stagefright Patch Incomplete and Zero Day in Android Google Admin App Found
msm1267 writes: A patch distributed by Google for the infamous Stagefright vulnerability found in 950 million Android devices is incomplete and users remain exposed to simple attacks targeting the flaw. Researchers at Exodus Intelligence discovered the issue in one of the patches submitted by Zimperium zLabs researcher Joshua Drake. Google responded today by releasing a new patch to open source and promising to distribute it next month in a scheduled OTA update for Nexus devices and to its partners. Drake's original patch failed to account for an integer discrepancy between 32- and 64-bit, Exodus Intelligence said. By inputting a specific 64-bit value, researchers were able to bypass the patch. Exodus, which submitted a bug fix of its own to Google, said it decided to go public with its findings for several reasons, including the fact that the vulnerability was widely publicized by Zimperium before and during Black Hat, not to mention that Google has had the original bug report since April, yet neither party noticed the discrepancy in the patch. The Android security team at Google is having a busy month. Trailrunner7 writes: Researchers at MWR Labs have released information on an unpatched vulnerability that allows an attacker to bypass the Android sandbox.
At this point, my next phone will be a bananaphone.
My old bag phone is looking better every day...
My question is, has there actually mean a successful exploit of the vulnerability? From the sounds of it address space layout randomisation, present since Android 4.0, would make it very hard if not impossible to execute an exploit. Just interested in what the real threat is and not the hyped up media version.
Go Samsung safety number 1.
It seemed for awhile several years ago that every other day there was a new nasty vulnerability in Windows XP. Some of these got exploited by nasty worms such as Blaster. Part of the issue was that Windows was designed without enough concern for security, something that really has changed in the past several years. But users also weren't installing Windows updates like they needed to, leaving them unprotected from exploits. That forced Microsoft to make some big changes in the design of Windows and to its practices in distributing updates. There are still plenty of Windows vulnerabilities, many of which are critical, but updates get distributed and installed much quicker and by a much larger proportion of the users. I'm less bothered by Android vulnerabilities being found and more concerned about how the patches get distributed. Android is a great target for criminals looking to exploit users because it has a large market share and many devices don't get updates regularly. I'd be far less bothered if I could trust that Samsung and Verizon would push out an update promptly, but that doesn't happen. I don't feel particularly vulnerable just because these security holes are being found; however, I don't trust that my Galaxy Note 4 will get an update pushed out to it in a timely manner. I'm not sure how seriously Google takes this, either, if they're going to wait until next month to release a fix. Microsoft did a lot to address the security issues with Windows. A similar thing needs to happen very soon with Android.
Actually can feel a little smug right now. My 30 dollar Lumia 520 running Windows 10 works great and since there aren't really any apps for it I don't have to worry about these apps messing with my phone being a well.. a phone.
Your smugness is simply arrogance or ignorance. You can bet there are vulnerabilities in WP10 and even without running "apps" you might be vulnerable. Anything other than the core operating system is an "app" anyway.
If you use an affected Android phone and avoid watching videos linked in SMS you'll be safe as well.
At least when a vulnerability is discovered in a Windows 10 based phone, Microsoft can roll out an update using a robust system instead of the circus Android has.
Why not just get a flip phone instead?
It's "just a phone" and will last a week or more without charging.
I wouldn't be surprised if flip phones outsell Windows Phone 10 by a significant margin.
Mod me down, my New Earth Global Warmingist friends!
In other words, since it is testing for a flaw, because it is based on a flawed requirement, is it reporting a false pass? :)
No piece of software is complete without a few NSA backdoors.
Exodus is wrong.
The flawed patch they mention in their post isn't the one being pushed to devices. What makes this funny is that the correct patch is in AOSP, for everyone to see. What Exodus posted is the patch that jduck suggested. And it's in AOSP here. But Google further updated it with this, which fixes the flaw Exodus noticed in jduck's fix.
There are still some known ways to crash libstagefright, but they're assertion crashes. They crash safely, no possibility of exploitation.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
With all the downsides maybe it's dumb to have a smart phone. I know that people would be missing out on all those important facebook posts though.
My ism, it's full of beliefs.
Why not just get a flip phone instead?
Because no one makes a flip as beautiful, well-made and small-footprint as the Razr.
That atrocity by LG the other day looks like a Razr with a tacky leather cover glued on to it -- that doesn't count. That's a near copy.
After the Razr, all flips are hopelessly plasticky fragile constructions.
My Razr lasted 6 years. Longest-lived phone i've had.
The "Civilized World" jumped the shark ca. 1973.
From the article:
The flaw was initially reported over 120 days ago to Google, which exceeds even their own 90-day disclosure deadline.
Do you remember them throwing Microsoft under the bus by releasing information about a flaw before it was patched? Yeah. Oops.
In summary, the Stagefright disclosure process was an interesting one to observe. The (un)surprising outcome being that given all the exposure this vulnerability received combined with essentially infinite resources on the vendor side, effective security mitigations were still not deployed. Google employs a tremendously large security staff, so much so that many members dedicate time to audit other vendor’s software and hold them accountable to provide a code fix within a deadline period. If Google cannot demonstrate the ability to successfully remedy a disclosed vulnerability affecting their own customers then what hope do the rest of us have?
I don't particularly dislike Google. I use Android and several of their services. Sometimes, however, their sense of self-satisfaction can get on my nerves, especially when they demonstrate themselves capable of the same flaws as their competitors but don't seem to own up to it.
Irony: Agile development has too much intertia to be abandoned now.
See the blog post.
I miss my Nokia 6162. Dropped it in the middle of winter. Found it after spring thaw. Got a Motorola v60i that I only replaced cause they turned off the old cell network. They felt so bad for me, they gave me a new phone free (not the free carrier phone).
In terms of UI, yeah I put it right around Windows XP. I mean most people compare Apple to Android just by looking at the UI. Hell its practically the same, just a few icons and the whole world goes crazy.
Told you.
-1 Factually Wrong: The NSA got ten times more data from one tenth as many users on Yahoo. And they got most of what they got from Google because they directly attacked Google's inter-datacenter fiber, not because Google cooperated.