Belfast Telegraph

UK Website Of The Year

Android Stagefright bug: Phones and devices have 'dangerous' security flaw leaving 950m open to hacks

Published 28/07/2015

Researchers said the 'Stagefright' hack works using a text message that does not even need to be opened to execute malicious code
Researchers said the 'Stagefright' hack works using a text message that does not even need to be opened to execute malicious code

Android phones can be hacked with text that does not even to be opened, according to a mobile security company.

Researchers at Zimperium have dubbed the attack “Stagefright” and claimed it could access 95 per cent of Android devices, an estimated 950 million around the world, although Google said no one had been affected.

Joshua Drake, the vice president of platform research and exploitation, said that a target’s mobile number is the only thing needed to launch the hack, which could theoretically hit anyone from government officials to company executives.

Stagefright arrives in a modified file delivered in an unremarkable MMS, which can bypass Android security to execute remote code and potentially allow access to files, storage, cameras and microphones.

Unlike phishing attacks, the user does not need to open the file for it to take effect and may not even notice it.

“A fully weaponised successful attack could even delete the message before you see it,” Mr Drake wrote.

“You will only see the notification. These vulnerabilities are extremely dangerous because they do not require that the victim take any action to be exploited.

“This vulnerability can be triggered while you sleep. Before you wake up, the attacker will remove any signs of the device being compromised and you will continue your day as usual – with a trojaned phone.”

Zimperium found that devices running Android versions 2.2 (Froyo) are after are vulnerable, especially those using anything older than 2012’s Jelly Bean (4.1).

Read more

Adobe Flash security vulnerability revealed

'Effective power' text message crashes iPhones

Edward Snowden shuns iPhones due to secret software that can be remotely activated to spy on people, says lawyer  

Android, the software platform for mobile devices based on the Linux, was developed by Google and the Open Handset Alliance.

Google has already released a patch to protect devices and plans to release more safeguards for its Nexus devices starting next week.

Zimperium also offers a fix and users of the privacy-focused Blackphone and Mozilla Firefox are protected.

Mr Drake is preparing to present his full research at security conferences Black Hat USA and Def Con 23 next month.

A spokesperson for Google said: “This vulnerability was identified in a laboratory setting on older Android devices, and as far as we know, no one has been affected. As soon as we were made aware of the vulnerability we took immediate action and sent a fix to our partners to protect users.

“As part of a regularly scheduled security update, we plan to push further safeguards to Nexus devices starting next week. And, we'll be releasing it in open source when the details are made public by the researcher at  Black Hat.”

The corporation is offering researchers payment and public recognition to expose security vulnerabilities in the Android Security Rewards Program.

Independent

Independent News Service

Your Comments

COMMENT RULES: Comments that are judged to be defamatory, abusive or in bad taste are not acceptable and contributors who consistently fall below certain criteria will be permanently blacklisted. The moderator will not enter into debate with individual contributors and the moderator’s decision is final. It is Belfast Telegraph policy to close comments on court cases, tribunals and active legal investigations. We may also close comments on articles which are being targeted for abuse. Problems with commenting? customercare@belfasttelegraph.co.uk

Read More