Stagefright - The most frightful Android bug ever!

Stagefright - The most frightful Android bug ever!

Sherlin Oneeta Bastin Sherlin Oneeta Bastin

Sherlin Oneeta Bastin

Security Engineering at Microsoft

发布日期: 2015年8月11日
+ 关注

Stagefright - What is it?

The most recently discovered Android bug is nicknamed Stagefright, after the Stagefright media playback tool in the Android operating system. This media playback tool helps Android phones unpack and process multimedia content, which includes video, audio, photos and text files.

The bug, which is found in this library, allows an unauthorized user to perform remote code execution in the device through a multimedia message.

In most cases, the victims are not even aware of the remote code execution, because the bug does not call for user action, especially if the default messaging application selected by the user is Google Hangouts.

This Hangouts application focuses on 'simplifying' the user-task and gets the videos ready for viewing, once the user opens the application. Hence, the Hangouts application processes the MMS messages and allows the attack to happen, not giving a clue of what is happening to the user.

Thanks to Joshu Drake, the Sr. Director of Platform Research and Exploitation of Zimperium, a privately-owned mobile-security startup, for finding this frightful vulnerability, which has put more than 900 million Android devices at potential risk.

Technically speaking, Stagefright is not a single bug, but a collection of seven bugs known so far. According to CVE, a dictionary of publicly known information security vulnerabilities and exposures, the following are the bugs that are identified to be within the Stagefright bug:

  • CVE-2015-1538,
  • CVE-2015-1539,
  • CVE-2015-3824,
  • CVE-2015-3826,
  • CVE-2015-3827,
  • CVE-2015-3828, and
  • CVE-2015-3829

 

Fix for Stagefright?

Although Google's Android security lead engineer, Adrian Ludwig, claims that the ASLR technology, which has been enabled in more than 90% of the Android devices currently, protects the users against the buffer overflow attack, this is not a perfect fix for the Stagefright bug. You may be one among the millions, who may wonder what this ASLR technology is all about.

The ASLR technology was originally enabled in the default Linux kernel in 2005, though it is currently enabled in other widely-available operating systems, too. This technology protects the devices from the buffer overflow attacks, as it randomly arranges the address space positions of key data, including the positions of the stack, heap and libraries.

This security technique makes it more difficult for an attacker to predict the target locations, because the key areas of a program or a service that is running are not put in the same location in RAM every time. Also, launching an attack by guessing the target location is an irreversible process. If the values entered by the hacker are wrong, the application crashes.

To the dismay of millions, this Stagefright has been a potential avenue to break into the system from the past five years. Once compromised, the hacker has complete access to sensitive data, photos, camera, and microphone of the device. No wonder the bug is called “The Mother of All Android Vulnerabilities”.

There are a few Stagefright bug detectors available online to detect and confirm the vulnerability of a device, but these do not offer a patch for the Stagefright bug. To protect yourself, you need to disable the 'auto-retrieval of MMS' option in the application that you have set default for messaging.

要查看或添加评论，请登录

Sherlin Oneeta Bastin的更多文章

  • Web Cache Deception Attacks
    2025年2月5日

    Web Cache Deception Attacks

    In simple terms, an adversary can force the reverse proxy server to store sensitive contents of a user in cache which…

  • Secure User Passwords by Adding Salt and Pepper
    2019年11月4日

    Secure User Passwords by Adding Salt and Pepper

    Let’s consider how a user, Bob, registers himself at a website and gets authenticated in a system where password-based…

    3 条评论
  • Forced Browsing - An Overview
    2018年3月9日

    Forced Browsing - An Overview

    Imagine the following scenario! You are an application owner who meticulously reviewed the application architecture…

    1 条评论
  • Women in Cyber Security - How Wide Is the Gender Gap?
    2017年4月24日

    Women in Cyber Security - How Wide Is the Gender Gap?

    I wish I could brush aside the figures and statistics that prove the existence of gender gap in the cyber security…

    7 条评论
  • Session Fixation Attack - Are You Secure?
    2017年1月20日

    Session Fixation Attack - Are You Secure?

    Session fixation is an attack technique that allows an attacker to hijack a session of the victim by forcing a user’s…

    5 条评论
  • Path Traversal Attack
    2016年10月30日

    Path Traversal Attack

    A simple definition of path traversal attack, also known as, directory traversal attack could be the following: This…

    3 条评论
  • Clickjacking - Is it a real threat?
    2016年9月9日

    Clickjacking - Is it a real threat?

    Yaay! Finally, I have landed at the right website to download my favorite song. Let me click the link and save it in my…

    31 条评论
  • Man-in-the-Browser (MitB) Attack – Are You a Victim?
    2015年11月12日

    Man-in-the-Browser (MitB) Attack – Are You a Victim?

    Man-in-the-browser attack, which is quite similar to man-in-the-middle (MitM) attack, is a highly effective and…

    11 条评论
  • Zero-Day Security Exploits
    2015年8月11日

    Zero-Day Security Exploits

    What is a zero-day security exploit? A zero-day security exploit is one, where a hacker finds and exploits a ‘hole’ or…

    16 条评论

社区洞察

其他会员也浏览了