Slashdot Mirror
Stagefright 2.0 Vulnerabilities Affect 1 Billion Android Devices
msm1267 writes: Security researcher Joshua Drake today disclosed two more flaws in Stagefright, one that dates back to the first version of Android, and a second dependent vulnerability that was introduced in Android 5.0. The bugs affect more than one billion Android devices, essentially all of them in circulation. One of the vulnerabilities was found in a core Android library called libutils; it has been in the Android OS since it was first released and before there were even Android mobile devices. The second vulnerability was introduced into libstagefright in Android 5.0; it calls into libutils in a vulnerable way. An attacker would use a specially crafted MP3 or MP4 file in this case to exploit the vulnerabilities. Google has released patches into the Android Open Source Project tree, but public patches are not yet available.
It's always been the audience that scares me, not the stage.
One of the great strengths of GNU/Linux is its diversity. Like biological life, it is constantly changing, morphing and becoming something new. And also like biological life, constantly changing helps protect against "bad stuff".
I hereby call for a "fork-fest" of Android - everybody make your own distribution of Android, remove code, add code, make it different. Android is sort of lip-service to the open source ecosystem. I'm not saying that this vulnerability is a result of that lip service, but I'd really like to see many, many other versions of Android out there - it's inevitable that the whole will become stronger because of it.
Because if everyone ate the same food we'd all probably die from the next super-virus that makes its rounds.
It is pitch black. You are likely to be eaten by a grue.
heartbleed, stagefright .. who the fu** comes up with these names? Seeking the media attention huh?
Much like Android's patching system, you are way too late.
--
"I have also mastered pomposity, even if I do say so myself." -Kryten
It's unfortunate that Google gave away so much control of Android. This means pretty much all Android devices are vulnerable, and unless the user has the skill and ability to install a non-vendor version of Android (eg: cyanogenmod), then these people are screwed.
Most android device manufacturers can't be bothered to release updates for their devices, and even when they do, you may still get railroaded by the carrier, leaving a very large number of devices vulnerable to who knows how many exploits. Of course, considering that Google itself has abandoned it's own devices within months of selling them, they arn't exactly a shining example either.
I'm waiting for the IoT to turn into the BoT (Botnet of Things).
To me, Android is a bit like Firefox. I only use it because it sucks the least. I don't like either one.
right?
Copyright (c) 1990 - 2014 Dice. All rights reserved. Use of this comment is subject to certain Terms and Conditions.
How do I inform Verizon and Motorola that I won't buy an android phone from them EVER AGAIN until they start supporting their products with security patches?
My phone STILL hasn't been patched from the first stagefright vulnerability. I've disabled functionality on the phone in order to protect it.
I'm downright upset about the lack of security fixes from Motorola/Verizon.
Seriously, how do I let those two corporations know in an effective way that they'll NEVER get another phone purchase from me until they've changed their do-nothing security practices? Not one penny!
The MMS/SMS app Textra has offered "stagefright protection" since stagefright1.0 was a think. Does this service offer any protection against 2.0?
I like how an Android bug is
"over 1 billion affected"
while i bugs like the font and pdf bugs are:
"hey, we can jailbreak, cool!" Never mentions numbers affected unless it's 10k or less.
The fact that these and the previous Stagefright bugs and others like them will never be fixed on most of the affected handsets, along with other nice things I'm hearing about the newer iPhones have me contemplating something that a year ago would have been anathema.
I may actually end up switching to an iPhone this fall instead of a new Android phone.
That may depend on some other things like root availability and CyanogenMod planning for possible handsets, but even with those a lot of the nice things on Android seem to be a product of the data being stored on Google's servers, while the impression I've gotten is that much more of Siri's appointment, etc. capabilities are managed at the point where it has access to the calendar - on the phone itself. I'm not feeling like I'll lose a lot of application capabilities since most apps on Android are going to have at least one solid corresponding app on iOS (in contrast to Windows Phone where I'm not sure there's even a really good text editor, much less a code editor).
fencepost
just a little off
I need access to Verizon towers because it is the only signal that I can get at work.
I first signed up with Page Plus Cellular, then moved to Tracfone after the America Movil buyout. I finally upgraded to a 4g device six months ago.
I can't run cyanogenmod because of Verizon's fascist bootloader locking. I do run an alternate touchwiz rom, and I have purged everything from it that mentioned Verizon.
And when Verzion shows up in my Facebook feed, I ask them why they lock their bootloaders and FORCE their users to run exploitable software, reminding them that Cyanogenmod nightlies has fixes, but Verizon doesn't and never will. It's also useful to speculate on a class action lawsuit after their userbase is owned.
Microsoft is missing a huge opportunity. Windows phones = no stagefright.
If you are really scared about MMS its pretty easy to fubar the settings to enable delivery of MMS messages. No big loss in the age of whatsapp, kik, line.
On the new variant it seems no different than desktop. Don't click links or view pages that may be dodgy. Don't download a ton of shit apps. And if someone is bothering to MITM you, problems are deeper than the exploit.