Latest in Gear

Image credit:

Stagefright exploit reliably attacks Android phones (updated)

It's now a real, consistent danger on affected phones.
32 Shares
Share
Tweet
Share
Save

Sponsored Links

You may know that the Stagefright security flaw is theoretically dangerous, but it hasn't been that risky in practice -- it's just too difficult to implement on an Android device in a reliable way. Or rather, it was. Security researchers at NorthBit have developed a proof-of-concept Stagefright exploit, Metaphor, that reliably compromises Android phones. The key is a back-and-forth procedure that gauges a device's defenses before diving in. Visit a website with a maliciously-designed MPEG-4 video and the attack will crash Android's media server, send hardware data back to the attacker, send another video file, collect additional security data and deliver one last video file that actually infects the device.

It sounds laborious, but it works quickly: a typical attack breaks into a phone within 20 seconds. And while it's most effective on a Nexus 5 with stock firmware, it's known to work on the customized Android variants found on phones like the HTC One, LG G3 and Samsung Galaxy S5.

This doesn't amount to an in-the-wild attack, and you'll be fine if you're running Android 6.0 Marshmallow or any other OS version patched against Stagefright. The catch is that relatively few people are in that boat -- most Android users are running Lollipop or earlier, and only some of those devices have Stagefright patches. You're probably fine if you own a relatively recent device, but your friend with a years-old Android phone is at risk.

Update: Google has provided a response that elaborates on what we knew: you're protected against this if your phone has least the October 1st, 2015 security update installed. Read the full statement below.

"Android devices with a security patch level of October 1, 2015 or greater are protected because of a fix we released for this issue (CVE-2015-3864) last year. As always, we appreciate the security community's research efforts as they help further secure the Android ecosystem for everyone."

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Comment
Comments
Share
32 Shares
Share
Tweet
Share
Save

Popular on Engadget

Engadget's Guide to Privacy

Engadget's Guide to Privacy

View
Disney+ public pre-orders are open, but without deep bundle discounts

Disney+ public pre-orders are open, but without deep bundle discounts

View
Facebook's Libra currency will get half its backing from the US dollar

Facebook's Libra currency will get half its backing from the US dollar

View
AMD delays 16-core Ryzen 9 CPU to November

AMD delays 16-core Ryzen 9 CPU to November

View
Erica's modular synth helps you make music with preset cards

Erica's modular synth helps you make music with preset cards

View

From around the web

Page 1Page 1ear iconeye iconFill 23text filevr