Biz & IT —

Attack code exploiting Android’s critical Stagefright bugs is now public

Google and partners sought delay releasing a patch.

Attack code exploiting Android’s critical Stagefright bugs is now public

Attack code that allows hackers to take control of vulnerable Android phones finally went public on Wednesday, as developers at Google, carriers, and handset manufacturers still scrambled to distribute patches to hundreds of millions of end users.

The critical flaws, which reside in an Android media library known as libstagefright, give attackers a variety of ways to surreptitiously execute malicious code on unsuspecting owners' devices. The vulnerabilities were privately reported in April and May and were publicly disclosed only in late July. Google has spent the past four months preparing fixes and distributing them to partners, but those efforts have faced a series of setbacks and limitations.

For one thing, some of the fixes—for instance, new versions of Hangouts and Messenger that blocked automatic processing of multimedia files sent over the MMS text protocol—were little more than Band-Aids. They blocked one of the most frightening of the attack scenarios while doing little to prevent others, such as exploits that relied on a user browsing to a malicious website. Also problematic, even when patches fixing the underlying cause were available to end users, at least one of them patching a flaw indexed as CVE-2015-3864 was so flawed that attackers can exploit the vulnerability anyway. Android apps such as this one from Zimperium—the security firm that first disclosed the Stagefright bugs—show that a Nexus 5 phone running all available patches remained wide open at the time this post was being prepared.

The setbacks prompted Google and its partners to ask Zimperium to delay releasing proof-of-concept code that exploits some of the bugs. But on Wednesday, the company finally published it. The python script generates an MP4 media file that exploits CVE-2015-1538 and gives the attacker a reverse command shell. The attacker is then able to take pictures and remotely listen to audio within earshot of the microphone. The exploit doesn't work against Android versions 5.0 and above thanks to new integer overflow mitigations.

Google responded to all the negative attention surrounding the Stagefright bugs by pledging to follow a monthly patch cycle for Nexus-branded handsets. Samsung announced a similar program for many of the devices it sells. It's anyone's guess how well the new programs will work, but with any luck they will allow Google to keep pace with industry-standard patching cycles followed by Microsoft, Apple, and Adobe.

Channel Ars Technica