The IT Nerd

If you’re an Android user, you have a big problem. The news is out that 1 billion Android devices are vulnerable to an new version of the Stagefright attack. Dubbed Stagefright 2.0, it is way more dangerous than the original Stagefright attack. Here’s what Threatpost had to say:

The risks with these vulnerabilities, dubbed Stagefright 2.0, are nearly identical to the original Stagefright flaws; the only difference is that the attack vector for the first bugs has been patched. Successful exploits would enable remote code execution and lead to privilege escalation, putting an attacker in control over a compromised device. They would have access to personal data and photos stored on the phone, be able to take photos, record conversations, exfiltrate email and SMS/MMS messages and load additional apps.

What’s worse is that these vulnerabilities, two in total have this sort of history. The first dates back to the first version of Android, and a second dependent vulnerability that was introduced in Android 5.0. Net result, Android users have a big problem. Google is likely aware of this, but the question is this. How long will it take Google along with every Android OEM to roll out fixes for this? Until they do, Android users have a big reason to worry.

A security researcher has claimed to have found a hack that can be executed by a text message and give the attacker complete control of the phone:

Here’s how the attack would work: The bad guy creates a short video, hides the malware inside it and texts it to your number. As soon as it’s received by the phone, Drake says, “it does its initial processing, which triggers the vulnerability.” 

The messaging app Hangouts instantly processes videos, to keep them ready in the phone’s gallery. That way the user doesn’t have to waste time looking. But, Drake says, this setup invites the malware right in.

If you’re using the phone’s default messaging app, he explains, it’s “a tiny bit less dangerous.” You would have to view the text message before it processes the attachment. But, to be clear, “it does not require in either case for the targeted user to have to play back the media at all,” Drake says.

Once the attackers get in, Drake says, they’d be able do anything — copy data, delete it, take over your microphone and camera to monitor your every word and move. “It’s really up to their imagination what they do once they get in,” he says.

This could affect 80% of Android phones out there and while it isn’t out in the wild yet, you can expect that now that this exploit is public, it will be. That’s not trivial. Neither is the fact that this will not get patched quickly despite the fact the fix is equally as trivial. That’s because the Android OS is incredibly fragmented with different versions of the OS being made available by Google, handset manufacturers, carriers, and the like. As a result, some may implement the fix quickly, others may implement it slowly, or some may not implement it at all. Thus you have to hope that wherever you get your Android OS updates from implement this fix before this becomes a real problem.

The BBC is reporting that there’s a flaw in Android that could leave you open to having your device taken over or your credit card info swiped. It was discovered by a company called BlueBox Labs and here’s a description of the flaw:

BlueBox has dubbed the vulnerability Fake ID, because it exploits a problem with the way Android handles the digital IDs – known as certification signatures – used to verify that certain apps are what they appear to be.

The issue is that while Android checks an app has the right ID before granting it special privileges, it fails to double-check that the certification signature involved was properly issued and not forged.

Jeff Forristal, chief technology officer of BlueBox, likened the issue to a tradesman arriving at a building, presenting his ID to a security guard and being given special access to its infrastructure without a phone call being made to the tradesman’s employer to check he is really on its books.

“That missing link of confirmation is really where this problem stems,” he told the BBC.

“The fundamental problem is simply that Android doesn’t verify any claims regarding if one identity is related to another identity.”

To make matters worse, he added, a single app can carry several fake identities at once, allowing it to carry out multiple attacks.

That’s not good. But what is worse is that while Google has fixed this, Android users will have to wait for the Samsungs and HTCs of the world to push updates down to them via their mobile phone operators. That could take months which means if you’re running Android 2.1 to Android 4.3, you are potentially open to attack. Thus the only way at present to protect yourself is to use an app from BlueBox to see if you’ve been affected by this.