950 Million Android Phones Can Be Hijacked By Malicious Text Messages 120
techtech writes: According to security firm Zimperium a flaw called "Stagefright" in Google's Android operating system can allow hackers take over a phone with a message even if the user doesn't open it. The vulnerability affects about 950 million Android devices. In a blog post Zimperium researchers wrote: "A fully weaponized successful attack could even delete the message before you see it. You will only see the notification. These vulnerabilities are extremely dangerous because they do not require that the victim take any action to be exploited. Unlike spear-phishing, where the victim needs to open a PDF file or a link sent by the attacker, this vulnerability can be triggered while you sleep. Before you wake up, the attacker will remove any signs of the device being compromised and you will continue your day as usual—with a trojaned phone."
idiots (Score:5, Informative)
Hey morons, you already posted this TODAY.
Re:idiots (Score:5, Funny)
Re: (Score:3)
Re:idiots (Score:4, Funny)
The first article isn't even gone from the front page yet. /. "editors" strike again.
I saw another dupe over the weekend. Maybe they're trying to appease all the old readers by making it seem more like pre-DIce Slashdot.
Re:idiots (OH NOES THE BOOGIE MAN GONNA GET YOU) (Score:1)
Hey morons, you already posted this TODAY.
Piece of shit Windows 10 comes out in a couple days. Some obscure-wtf-bullshit site zimperium(?!) posts on their own blog. So now it's the end of the world. All Androids are fucking rooted while you slept last night. Aw shit. Damn. This is supposedly because of vulnerable MMS video lag prevention features in "stagefright libraries".
FUD. 2x dupe on Slashdot raises the credibility eyebrow. c|net has had zero credibility with me for many years.
http://www.digitaltrends.com/mobile/android-stagefright-mms
Editors don't read slashdot, maybe Google? (Score:2)
If editors don't read Slashdot itself maybe they should Google their own website. I mean a simple search like: "Android Malicious Text url:slashdot.org" returns both articles.
If editors google what they are about to post they can outsourse the job of reading the very site where they manage content.
Re: (Score:1)
That iPhone venerability has already been patched.
older devices don't get patched.. (Score:2)
for iphone 4 as well? I don't think soooo.
anyhow... expect mobile networks to filter these messages in 1.2.3.4....
either that or 400 million phones in use in asia will receive an attack today if the attack really works as described in the blurb (proof of concept that installs something or gtfo).
(if you browse on a mobile from asia you might notice that shitloads of adverts that try to exploit or trick the user into installing sw. even slashdot carries occasionally ads targeted to asia tha will just straig
Re: (Score:3)
Re: (Score:3)
Re: (Score:2)
Re: (Score:1)
A Windows phone just doesn't give a good enough reward to exploit or find exploits for, it's not that there aren't vulnerabilities.
It is nice to see we've come full circle. That has been the Microsoft defense for years for Windows and everybody is quick to downplay it.
I've yet to see lag or stutter on an Android device, though I suspect that has to do more with buying crap phones than the OS
My HTC One M8 lags and stutters and I have to reboot it. Granted, not all the time, but it certainly does. You might want proof, but I'm too lazy for that, so you'll have to take it from me or ignore it. Plus, Windows pones are rumored to perform well even on low end HW, but hey, that's only what I've heard.
...and the UI looks like the garbage 8 interface.
Personal opinion. So, I really like the interface on both Windows
..all versions of Android after and including 2.2 (Score:5, Insightful)
Re: (Score:2, Insightful)
You can blame the carriers for much of that fragmentation.
Finger pointing.
The time-worn bullshit excuse that obviously never gets old.
If at first you don't succeed, fucking blame someone else.
Re: (Score:1)
What's wrong with blaming the people responsible for the issue?
Re:..all versions of Android after and including 2 (Score:5, Insightful)
It's the phone makers' faults. Sorry, but that's just the way it is.
Apple has shown that it's possible for the device manufacturer to deploy new software directly. Yet in the Android world, it's still the carriers doing it. There's only a few phones where the manufacturer pushes new updates (and even those don't tend to be supported as long as iPhones do)
The Android world needs to wake the hell up and start supporting its users properly. It's ridiculous that this sort of situation can happen; if a similar exploit appeared for iOS, Apple would patch devices in 10 seconds flat.
Re: ..all versions of Android after and including (Score:5, Interesting)
Coming from an android user, the gp is absolutely correct. Allowing carriers to decide whether updates are pushed out simply means that they never do so. It's the top item on the [fairly short] list of things that I wish would be copied from Apple.
Re: (Score:2)
If at first you don't succeed, fucking blame someone else.
Stop it, you are embarrassing yourself.
You read the part where Google patched AOSP in 48 hours right? WTF do you want them to do? They don't have the ability push updates to phones issued by Verizon et al., let alone some oddball carrier in Thailand.
Re: (Score:1)
No, you can blame Google.
Blame the users: here's why (Score:3)
As usual, I prefer to blame the victims (us).
On a desktop personal computer, it would never occur to you to think "Oh, I just assume I'll get software maintenance from my ISP," and if anyone ever actually said that then you would point your finger at them and laugh and their over-the-top stupidity.
But change the form factor of the personal computer to handheld and suddenly we don't do the pointing and laughing. On the very face of it, it's JUST AS STUPID. So WTF?
Users are not exercising their common sense.
Re: (Score:2, Informative)
Re: (Score:2)
CM and nearly all custom roms are immune and Lollipop is completely unaffected. Next time don't buy a carrier device.
Some of us don't have a choice, some of us still don't have a choice. Welcome to Canada.
Re: (Score:3)
What are you talking about? What does being in Canada have to do with it? I have rooted, unlocked, and installed CM on several devices including my Virgin Mobile Galaxy S1 and a Kudo Galaxy S2. And all the carriers here allow you to bring your own device if you wish. I brought my unlocked S2 to Telus.
Re: (Score:2)
Similar setup here, my wife just switched to Fido after unlocking her HTC One. The plan is $15 cheaper if you bring your own device.
Re: (Score:3, Informative)
That is completely wrong. The blog post by the folks who discovered the vulnerability even includes screencaps of Lollipop 5.1.1 being taken over via MMS. Not sure where you got the idea that Lollipop and CM are unaffected.
Re:..all versions of Android after and including 2 (Score:5, Informative)
EXCEPT 5.0 Lollipop, because Lollipop uses a different media framework. Which I'm sure has its own issues, but thankfully, even a year after release, its marketshare is tiny enough that it doesn't matter.
Even worse, it's a bug inside the OS itself, so it's not like Google can actually fix the problem like they have using Google Services Framework.
It can only be fixed by a rooted device or a software update to replace the broken library.
Rooting is over-rated (Score:5, Informative)
"It can only be fixed by a rooted device or a software update to replace the broken library."
"Rooting" (or allowing runtime access to root-level functions) is unnecessary for fixing any Android OS-level problem. However an unlocked bootloader will allow you to install an unofficial update or patch (unfortunately also allowing you to install a malware). A "rooted" device is actually even more of a security risk, especially if you have to trust a closed-sourced "superuser" binary.
Note that I distinguish between "rooted" Android systems that allow you to gain root level access on demand and those setups that allow for off-line root access via special recovery or debug modes that require a reboot and so is not available when running the system normally.
Rooting is under-rated (Score:4, Insightful)
When the critical Samsung keyboard exploit hit the news, I was able to do this (and you were not):
mount -o remount,rw /system /system/app . /system
cd
mv SamsungIME.apk SamsungIME.banished
scp cyanogen:/tmp/LatinIME.apk
cd
mount -o remount,ro
reboot
I have no intention of relinquishing my ability to repair this vendor-inflicted brain damage because of your foolish misconceptions.
Re: (Score:1)
EXCEPT 5.0 Lollipop, because Lollipop uses a different media framework. Which I'm sure has its own issues, but thankfully, even a year after release, its marketshare is tiny enough that it doesn't matter.
Even worse, it's a bug inside the OS itself, so it's not like Google can actually fix the problem like they have using Google Services Framework.
It can only be fixed by a rooted device or a software update to replace the broken library.
This is completely wrong: 5.0 and 5.1 all include stagefright library. Nuplayer has been around for awhile and is a counterpart to Stagefright. Android has been moving toward deprecating Stagefright and replacing it with Nuplayer. In 5.0 this started with the inclusion options to allow manufactures to use nuplayer or stagefright as the default. Since nuplayer is still considered experimental there are been compatibility issues so most manufacturers shipped their 5.0 and 5.1 builds with the default stil
Re: (Score:2)
If it can be exploited remotely for root access then it can be patched remotely by a non-vendor. I guess we will see stagefright patch apps start appearing over the next few days.
Obviously, nobody can rely on the lame-ass vendors, even if they had their heart in it.
I'm okay... (Score:2)
No Android.
No smartphone.
No cellphone.
My telephone's an old fashion really dumb land line. One thing you gotta love about being behind the times is not getting hacked.
Re: (Score:2)
If you never use any computer you're even safer. I suggest you throw out the one you typed this on.
Re: (Score:3)
I'd think his public library would be upset by that.
Re: (Score:2)
No, this article was specific to the Android. Try to stay on topic no matter how your mind wanders...
Re: (Score:2)
You must be awfully fun at all the parties you never get invited to.
They're horrible at parties. Always bugging people who are on their phones with trying to talk face to face and stuff.
Re: (Score:2)
Pfft. I'm outside your house clipping my orange lineman's handset into your Bell box, so I can listen to all your calls.
Wait until I tell the guys at 2600 Magazine about this! er33t h4x!
Re: (Score:2)
Have fun. I hope you don't get too bored since I almost never use the phone and I never say anything on it that matters... Virtually all of my communications are via email - which is an open postcard so nothing interesting there either - and email is not hackable. It is the Android system that is the subject of the hacking in the original poster's article or perhaps you didn't read that. That's why candles, tin cans, old dial up phones have an advantage - they're simply not remotely hackable. So hook into t
Re: (Score:2)
My telephone's an old fashion really dumb land line...
Oh I know, right? I keep a couple tin cans and some string around in case things get really bad.
Re: (Score:2)
One nice thing about using candles is not having to worry about power failures.
(I don't get this attitude; depriving yourself of cool things so you don't have to deal with the inconvenience of those things breaking?)
Re: (Score:2)
Ah, but there's the rub. You think the Android phone a cool new thing. What Smartphones really are is gussied up old tech (voice) with a new suit that makes them more vulnerable. I very rarely use voice phone. I use email which is far faster and more efficient. I also don't communicate things via email that are worth "listening" into so the fact that email is a postcard is not an issue either. In either case, you can't hack my email the way the Android phone hack is being done - that was the point of the or
Dupe (Score:1)
http://it.slashdot.org/story/15/07/27/1416257/stagefright-flaw-compromise-android-with-just-a-text
Omg (Score:1)
A fully weaponized attack could take screenshots and camera pictures of you tossing off at Wikiarmpits.
Old tech is good tech (Score:2)
And this is why I use a $9 phone that has support for nothing other than voice calls and plaintext SMS. Not only is it free from the effects of such exploits but the battery also lasts two weeks between charges, it fits very nicely in even the smallest pocket and doesn't distract me when I should be working or spending time with friends and family.
I only upgraded to this phone because I found the cranking handle on the side of my old phone was snagging on my pocket and the operator was sometimes very slow
Re: (Score:2)
Surely the trailing wire back to the exchange was a bigger problem?
Rgds
Damon
Re: (Score:1)
But does it work on verizon? Most of the cheap basic phones ive seen are gsm only.
Re: (Score:2)
Would you want it to work on Verizon? I mean, they're advertiser-friendly unique-id headers alone should make you swear them off.
Re: (Score:1)
First they do actually let you turn of the uuid thing now.
I turned it off same day they added the option to do so.
Still annoyed about that but aside from switching to a less reliable provider not a lot else I can do.
Second I don't actually do a lot of browsing on my Samsung convoy 3 the ssl warning in combination with the small screen makes it a serious pita just to look up the weather.
Third att/sprint/tmobile all have pretty crappy service by me although att has gotten much better in my area in the last co
Re: (Score:3)
And this is why I use a $9 phone that has support for nothing other than voice calls and plaintext SMS. Not only is it free from the effects of such exploits but the battery also lasts two weeks between charges, it fits very nicely in even the smallest pocket and doesn't distract me when I should be working or spending time with friends and family.
You insensitive fucking clod, my wife read that, got all excited, and left me. Said something about wanting to have your babies. You must get that a lot though.
Slashdot kooks are getting like that crazy uncle who brags about not having email. Or a computer.
MMS vector (Score:5, Informative)
TFA (requires obnoxious CAPTCHA just to read, wtf) makes it clear the payload is inside a media file attached to an MMS. Myself I do not use MMS since it seems to require OTA data to download the MMS payload, which is exceedingly expensive on my current prepaid plan. Old phones are pretty likely to be used like this; voice only, data only over wifi, so it might lessen the impact. Anyways, I am on Lollipop.
Re: (Score:2)
Better yet, with t-mobile you'll never get any messages anyway because they have no network t speak of
Re: (Score:2)
tmo doesn't have a unlimited plan, if that's what you're implying. I'm on the most expensive tier and it's 5gb.
Re: (Score:3)
Why don't vendors and carriers get sued/fined? (Score:1)
When I buy a new phone, it generally involves a two year contract. Even without a contract, it's reasonable to expect that a new phone will be supported for a couple of years. For phones where the carrier controls the software, like Android, that seems to be an implicit part of the service that the carrier is contracted to provide. I don't agree with lawsuits for buggy code, provided that there isn't negligence involved. However, when the vendor and carrier are aware of a problem and fail to provide a solut
Re: (Score:2)
I recognize that this doesn't put lives at risk
System-corrupting malware installed onto an on-call doctor's phone via this exploit, causing a boot-loop so no calls or messages can get through.
Question with data mode on/off (Score:2)
Re: (Score:2)
The source is out there (Score:2)
Is the patch available?
TURN OFF MMS (Score:3)
or never configure it in the first place to work.
that's your fix.
and slashdot editors: MMS IS NOT SMS SO FUCK YOU SLASHDOT EDITOR. it's not even remotely same technlogy.
mms is vulnurable? duh. how about sharing the image preview vuln(presumably) that's actually used since that has much more to it than just mms. but that mms implementation is exploitable is quite a bit less fatal/interesting than sms vuln.
besides than that I'm pretty fucking sure that 950 million android phones (total androids out there) don
Use TextSecure / SMSSecure (Score:1)
It'll give you a warning before stagefright is used
https://github.com/WhisperSyst... [github.com]
you can find SMSSecure on f-droid
Also check to make sure hangouts isn't using mms (just to be on the safe side)
CyanogenMod (Score:5, Informative)
Concerning CyanogenMod, this was posted to their Facebook page [facebook.com] a few hours ago:
Recent Stagefright issues
The following CVE's have been patched in CM12.0 and 12.1 nightlies for a couple weeks. If you haven't updated already, we strongly encourage you to do so.
CM11 will see these updates hit as part of out of band fixes this weekend (these releases occur weekly).
CVE-2015-1538
CVE-2015-1539
CVE-2015-3824
CVE-2015-3826
CVE-2015-3827
CVE-2015-3828
CVE-2015-3829
We are actively following all the DefCon events and announcements and will be keeping tabs on other disclosures that could impact CM and its derivatives.
ï
Using a MMS (Score:2)
Seriously, do people really use MMS? Just disable MMS (if have enabled it) and you are safe as it seems.
What is the purpose of MMS? Paying 100x more to send the same contents which could be sent using an email?
Re: (Score:3)
Why is the platform not OTA-upgradeable? (Score:2)
Wrong title (Score:1)
Try proofreading next time? (Score:3)
"According to security firm Zimperium a flaw called "Stagefright" in Google's Android operating system"
Um, the flaw isn't called stagefright - the flaw is in a component called stagefright!