Menu
New Stagefright exploit puts millions of Android devices at risk

New Stagefright exploit puts millions of Android devices at risk

Researchers continue to find problems in Android's multimedia library

Millions of Android devices are at risk yet again after researchers found a new way to exploit an older vulnerability that was previously patched by Google.

NorthBit, based in Herzliya, Israel, published a paper outlining Metaphor, a nickname for a new weakness they found in Stagefright, Android's mediaserver and multimedia library.

The attack is effective against devices running Android versions 2.2 through 4.0 and 5.0 and 5.1, NorthBit said.

The company said its attack works best on Google's Nexus 5 with stock ROM, and with some modifications for HTC's One, LG's G3 and Samsung's S5.

The attack is an extension of other ones developed for CVE-2015-3864, a remote code execution vulnerability which has been patched twice by Google.

The security company Zimperium found the original Stagefright flaws in early 2015, which affected millions of devices. Google has since had to repeatedly issue patches and fixes for problems in Stagefright that researchers continue to find.

Zuk Avraham, CTO and founder of Zimperium, said via email his company withheld publishing a second exploit it developed for Stagefright due to the risk it posed and the large number of devices that could still be affected.

But NorthBit's research paper "provides enough details for professional hacking groups to complete a fully working and reliable exploit," he said.

NorthBit published a video of a successful attack, which requires a bit of social engineering. The victim has to be tricked into clicking on a link and then staying on that Web page for some time while the exploit runs. It can take between a few seconds to up to two minutes for the exploit to finish its work.

In the video, the victim, who is using a Nexus 6, opens a link leading to cat photos, while NorthBit shows the exploit churning away.

On Android versions 5.0 and 5.1, the exploit will bypass ASLR (address space layout randomization), a defense intended to make exploitation more difficult.

NorthBit estimated about 235,000,000 Android devices run versions 5.0 and 5.1, and about 40,000,000 devices run some 2.x version of Android without ASLR.

"Looking at these numbers, it's hard to comprehend how many devices are potentially vulnerable," NorthBit wrote.

Partly in response to danger posed by Stagefright, Google said in August it would move to a monthly patching schedule and work closer with major Android vendors to ensure more prompt patching.

Google will likely quickly issue a patch, wrote Chris Eng, vice president of research with Veracode, in an email. But the distribution of Stagefright patches has been spotty.

"Patching application vulnerabilities is especially challenging for the Android community with the number of different manufactures and carriers charged with the responsibility of issuing patches to devices," Eng said.

Google could not be immediately reached for comment.

(Steve Ragan of CSO contributed to this report.)

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags securityStagefright

Slideshows

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

Ingram Micro completed its nationwide roadshow in Auckland last month, kicking off its Innovation Hour series with Hewlett Packard Enterprise. Uncovering the latest in storage, networking and servers, the event outlined key market trends for resellers in 2016 and beyond.

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise
IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

FireEye welcomed 143 channel partners and distributors to FireEye's 2016 annual Partner Conference, FireEye A/NZ Momentum - held at Establishment in Sydney. Delegates heard from senior trans-Tasman channel leaders, marketing and the product divisions in the morning, with FireEye customers, incident responders and threat intelligence analysts sharing knowledge during the afternoon.

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference
​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​

​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​

With New Zealand businesses now open to innovation, the industry sits on the cusp of significant disruption in the data centre. Driven by software-defined networking, the future of the data centre is fast becoming reality, as the channel seeks to keep up, keep innovating and keep growing. APC by Schneider Electric, Lenovo and key partners outlined how the channel can capitalise at The Grill restaurant in Auckland.

​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​
Show Comments