Slashdot Mirror
Millions of Android Devices Vulnerable To New Stagefright Exploit
An anonymous reader writes: Security researchers have found yet another flaw in Android's Stagefright. The researchers were able to remotely hack an Android phone by exploiting the bugs. According to their estimation, the flaw exposes devices running Android software version between 5.0-5.1, or 36% of 1.4 billion, to security attacks. "I would be surprised if multiple professional hacking groups do not have working Stagefright exploits by now. Many devices out there are still vulnerable, so Zimperium has not published the second exploit in order to protect the ecosystem," Zuk Avraham, chairman of Zimperium, the firm which found the first Stagefright exploit told Wired.
That's not what this is. TFP is careful to point out that all it gets you is executing arbitrary code in the process that is affected, in this case the browser. So you would need further exploits to get anywhere from there.
Even that is difficult as it requires knowing certain things about the target device, like the exact ROM it is running. It also looks like Google should be able to mitigate is pretty quickly by updating Chrome and various system components via Play.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Ever notice how the feds never go after Google or the Android phone makers to unlock things? They don't need to, they've been able to go balls-deep in Android since Day One. Too bad only Apple seems to give a poop about security.
It would take me too long to write a full rebuttal for your post, but to summarize: 1) The feds DO go after Google and OEMs to unlock phones. 2) Cheapo Android phones are insecure. But Nexus phones get prompt security updates straight from Google. Samsung is also nowadays rigorous about securing their flagship phones, since they're approved by the DoD for government employee usage (cf. "Samsung Knox").
Not when there is already an "official" method that requires a physical manipulation.
A typical Android root method that is tolerated by manufacturers requires you to reboot, press a specific button combination, connect your device to a computer via USB and run a program on the computer. This way, you can be reasonably sure that the user is the one why initiated the root procedure and not some malware. Root has serious security implications, so anything that guarantees that it really is the user's choice is a good thing.
Android is not iOS, there is plenty of choice for devices that can be rooted without shady exploits. We shouldn't rejoice when such vulnerabilities appear.
Well, given that is about 1/3 of all androids in the wild, everyone should be checking.
https://developer.android.com/...
Also, other places say all versions of Android 2.2 & above are affected, which is ~95%
http://www.wired.co.uk/news/ar...
From the PDF: "The victim also has to linger for a time in the attack webpage"
Since I don't use my phone for browsing*, I guess I'm safe for the moment.
-
*Yeah, I just use it to make calls and take calls, and maybe snap the occasional picture. Weird, huh?
Just cruising through this digital world at 33 1/3 rpm...