A billion Android phones are vulnerable to new Stagefright bugs

Stagefright 2.0 comes as Android users were still recovering from Stagefright 1.

Ron Amadeo

There's a new round of Stagefright vulnerabilities that allows attackers to execute malicious code on more than one billion phones running ancient as well as much more recent versions of Google's Android operating system.

Stagefright 2.0, as it's being dubbed by researchers from security firm Zimperium, is a set of two bugs that are triggered when processing specially designed MP3 audio or MP4 video files. The first flaw, which is found in the libutils library and is indexed as CVE-2015-6602, resides in every Android version since 1.0, which was released in 2008. The vulnerability can be exploited even on newer devices with beefed up defenses by exploiting a second vulnerability in libstagefright, a code library Android uses to process media files. Google still hasn't issued a CVE index number for this second bug.

When combined, the flaws allow attackers to used booby-trapped audio or video files to execute malicious code on phones running Android 5.0 or later. Devices running 5.0 or earlier can be similarly exploited when they use the vulnerable function inside libutils, a condition that depends on what third-party apps are installed and what functionality came preloaded on the phone. In a blog post published Thursday, Zimperium researchers wrote:

The vulnerability lies in the processing of metadata within the files, so merely previewing the song or video would trigger the issue. Since the primary attack vector of MMS has been removed in newer versions of Google’s Hangouts and Messenger apps, the likely attack vector would be via the Web browser.

1. An attacker would try to convince an unsuspecting user to visit a URL pointing at an attacker controlled Web site (e.g., mobile spear-phishing or malicious ad campaign)
2. An attacker on the same network could inject the exploit using common traffic interception techniques (MITM) to unencrypted network traffic destined for the browser.
3. 3rd party apps (Media Players, Instant Messengers, etc.) that are using the vulnerable library.

Further Reading

950 million Android phones can be hijacked by malicious text messages

Booby-trapped MMS messages and websites exploit flaw in heart of Android.

Further Reading

Waiting for Android’s inevitable security Armageddon

Editorial: Android's update strategy doesn't scale, and that's recipe for disaster.

Zimperium researchers found an earlier round of vulnerabilities that also made it possible for attackers to remotely hijack Android phones. Those bugs, all residing in Android's libstagefright, were especially alarming because they could be exploited by booby-trapped media files included in a text message. Google has since redesigned its Hangouts and Messenger apps to prevent that possibility. More recently, company developers have also fixed the underlying vulnerabilities in newer versions of Android, although those updates remain unavailable to many users. Members of Google's Project Zero security research team recently found that Android's address space layout randomization provided only minimal protection against Stagefright exploits.

 Google representatives have said the new round of Stagefright bugs will be fixed in an update scheduled for release next week. Once Google makes the update available, it could take as long as a week for it to become available to users of Google-branded Nexus phones and even longer for other brands.

arstechnica.com  2 Oct 2015.