Exploit For Stage Fright Serious Flaw In Android Public

Researchers at the end of July, a serious leak revealed in Android have now published the exploit code that vulnerability on a single Android model can be attacked. The vulnerability allows an attacker to send arbitrary code to execute an MMS message, steal information, read e-mails and other tasks.

In the case of older Android devices, it is even possible to completely take over the device. The vulnerability is in Stage Fright, a media library that handles various popular media formats. Because of the severity of the problem decided Zimperium, the company that discovered the vulnerability, not to immediately publish the exploit.

Since the announcement, several manufacturers rolled out updates to protect users from the issue. Google also has new versions of Messenger and Hangouts released to automatic processing of multimedia files to block received via MMS.According Zimperium is therefore now the time has come to publish the exploit code, so that administrators and security professionals to test their systems.

However, the exploit has several limitations. It is not a generic exploit and works only against a single model, namely a Nexus to Android 4.0.4 running. The exploit is not 100% reliable. In addition, the vulnerability is attacked where the exploit makes use of rectified by security in Android 5.0 and newer.

T-Mobile Temporarily Stopped Due MMS Stage Fright Leak

T-Mobile has temporarily stopped supporting MMS messages because of the Stage Fright leak , so the telco through its own forum disclosed. Stage Fright allows attackers via a single MMS message execute malicious code on Android devices. Although no attacks have been observed in the wild yet, T-Mobile has decided after a risk analysis to the "legacy mode" for MMS to turn.

This means that customers no longer received directly into their messaging app, the MMS media content. Instead, they receive an SMS notification containing a web link and a password to view the contents of the MMS message via a separate web portal. T-Mobile is warning customers that the risk remains that an MMS message is infected with the "Stage Fright virus". Customers with their Android smartphone to view the message in the web portal run thus still a risk of getting infected.

"Basically, this provides no real protection you but we thus avoid the risk of an even greater tragedy with a super-fast distribution and prolonged '' know ping-pong" effect ", let the provider. However, an employee reported that the technical department and the central MMS provider T-Mobile possibly next week come up with better alternatives to the measure. "If that is a fact, then I leave to return to the service in normal mode," said employee ' Mark K . Some customers are not very happy that they are not informed in advance about the measure because the MMS service suddenly stopped working. 

Attack On Very Serious Android Leak Nearly Public

On a Chinese forum has published information about how a very serious flaw in Android can be used to attack millions of Android phones via only a single MMS message, although the vulnerability also through apps and websites exploit. Reported security Zimperium.

Zimperium discovered the vulnerability, which called Stage Fright got. Later it turned out that anti-virus company Trend Micro same vulnerability was independently discovered . According Zimperium the problem affects 950 million Android devices. It is estimated that in 50% of the sensitive devices the attack without any user interaction to perform. In other cases, opening an MMS sufficient.

Right

The attack an attacker could execute arbitrary code with system privileges or media on the device. Thus, an attacker could take complete control of the camera and microphone, for example, to monitor users. On some handsets running the vulnerable software that is attacked via the MMS message with system privileges. In this case, an attacker elevated privileges and can do almost anything on the device that the user can. Zimperium argues that this is, however, "some" equipment. An attacker could execute arbitrary code on a device, even if the media rights, then may however try to increase his rights.

Originally publish at the Black Hat security conference in Las Vegas this week an exploit. Several organizations asked Zimperium to wait this. Something the company has agreed with it. The security updates for Android, however, are open source. Therefore, many researchers now work on an exploit to attack the vulnerability, reports the company. "We therefore believe that it is only a matter of time before we see attacks in the wild, assuming they do not already take place", said security researcher Zuk Avraham of Zimperium last Saturday knowing. This morning the company warned via Twitter that an exploit is now almost public.

Updates

The problem is that many Android users to update their phone company or the manufacturer of the device are dependent, instead of Google. Therefore it can take a long time updates ultimately be offered if the device is still supported. Several older Android models that are vulnerable and are no longer supported miss an important security measure. As a result, the impact on these devices is much greater.

It would total to about 60 million sets. According to Avraham, an attacker will create a network worm to send MMS messages.Together would the aircraft, after being infected, can send six billion MMS messages per day. Something that could have consequences for the network of telecom providers.

Actions

Users who want to protect themselves getting Zimperium the advice to keep the device up to date. In case the device is no longer supported, users on an operating system such as CyanogenMod switch that supports older devices longer. Another measure that can be taken is to disable automatic retrieval of MMS messages.

Seriously Android Leak Also To Attack On Apps And Websites

This week it was announced that there was a very serious leak is present in Android which allows an attacker installed on millions of Android phones malware by only sending a single MMS message. Stage Fright, such as the vulnerability is known, however, is also to attack in other ways, according to the Japanese anti-virus company Trend Micro .

Security Zimperium Stage Fright made known this week. Trend Micro says that it has also found the same vulnerability independently of Zimperium and on May 19 of this year has been reported to Google. This implies that at least two parties have discovered a critical vulnerability of this magnitude and this then Google decided to report.

Attack Vectors

Trend Micro, however, that there are more ways to use Stage Fright. In addition to sending an MMS message, an attacker can use an app to attack the vulnerability, and the use of a website. The vulnerability is caused by the way the Android media server handles MP4 files. This allows an attacker to cause a heap overflow and then execute arbitrary code such as installing malware.

In addition to sending a malicious MP4 file from an MMS message, it is also possible to embed such a file in a Web site or by allowing an app to open, and thereby infect an Android phone with malware. Google has already rolled out an update, but many Android users for patches depend on their telecom provider or manufacturer of the device if the device is still supported.According to Trend Micro, the problem in Android version 4.0.1 to 5.1.1, which represents 94% of all Android devices.