The scare that the original Stagefright hack caused is back in a reboot called Stagefright 2.0. This new strain was discovered by Zimperium zLabs, the same folks who found the original vulnerability.
Unfortunately, the really bad news is that Stagefright 2.0 affects almost every Android device ever released. According to Google’s latest stats, that’s about 1.4 billion devices worldwide. Even worse, it doesn’t matter if your device received a patch for the original Stagefright hack because this is a completely new vulnerability.
What is Stagefright 2.0?
Stagefright 2.0 is actually very similar to the original in that it deals with a media file containing malicious code that once executed, will give a hacker control of your device. In the case of Stagefright 1.0, it dealt with MP4 video files, but Stagefright 2.0 code can be executed from both MP4 video and MP3 audio files.
Just like the original, hackers would have access to all your data, and even be able to access the microphone and camera once the malicious code is executed.
The name Stagefright comes from the media playback engine in Android that has the same name. This playback engine is where the vulnerability resides, which Stagefright 2.0 can take full advantage of.
There are two vulnerabilities of Stagefright 2.0. The first one resides in libutils and affects almost every Android device since 2008. The second one resides in libstagefright and can be used on devices running Android 5.0 and higher.
How it works
The hacker would need to get an MP3 audio or MP4 video containing the malicious code on your device. The process of merely previewing the song or video would set the malicious code in motion.
The original Stagefright hack involved sending an MMS message of the malicious video file that Google Hangouts or other third-party Messenger apps would receive and automatically download. Patches have been issued for a number of devices, but users who don’t have a patched phone also have the ability to defend themselves by setting their apps to not download such media files automatically.
Since hackers can no longer use Google Hangouts or other Messenger apps, they have to use other methods to get a media file with Stagefright 2.0 code on your device. This can be done via a Web browser in that the victim is duped to visit a URL that is controlled by the attacker. An attacker could also use third party apps that would automatically install and possibly play a malicious media file. Finally, an attacker could manipulate your device by using common traffic interception techniques (MITM) if they are on the same network. This one is the least likely.
What is Google and other manufacturers doing?
Zimperium notified the Android Security team on August 15, and Google will issue a fix for the first vulnerability (libutils) next week. This will be pushed to Nexus devices, and is likely going to be included in the Android 6.0 Marshmallow update. Google has assigned CVE-2015-6602 to this vulnerability.
Google has yet to assign a Common Vulnerabilities and Exposures (CVE) number to the second vulnerability (libstagefright), so it’s not clear when a patch will be issued.
Zimperium also sent an update to the company’s Zimperium Headset Alliance (ZHA), which includes most major Android manufacturers. This information can be used by manufacturers to patch existing and upcoming devices.
Unfortunately, it’s unlikely that older devices, especially two years an older, will ever get the update. Manufacturers notoriously abandon older devices. While newer devices will likely receive the update, they will most likely get delayed due to carrier testing.
How can you defend yourself?
Unfortunately there isn’t much you can do at the moment, but we recommend the following:
- Always download apps from Google Play or the Amazon App Store. Avoid other app stores, and do not sideload apps from untrusted sources.
- Pay attention to the websites you’re visiting and don’t click on links in emails and text messages from people you’re not familiar with.
- Download the Stagefright Detector app to find out if you’re device is affected. As of the time of this post, the app cannot detect Stagefright 2.0, but Zimperium will be updating it once Google issues its patch.
We will continue to update this post when Google and other manufacturers issue patches or if any new methods of defending yourself are discovered.
