Researchers find vulnerability that affects 95% of Android devices

Image Credit: Google

Update: This article has been updated with a comment from Google.

Researchers have found a vulnerability in Android devices that allows hackers to access a device remotely without the owner ever knowing it was compromised. The flaw affects roughly 95 percent of Android devices running operating system version 2.2 to 5.1, according to cybersecurity firm Zimperium.

At fault is a media library (used to process media files) called Stagefright.Zimperium says it found multiple vulnerabilities in the framework. The company plans to present its research at the Black Hat 2015 security conference and at the hacking conference Def Con in August.

Using a person’s telephone number, hackers can send a media file via MMS that gives them entry into a device. What’s more, the owner of the device may never know. Hackers could conceivably send the trojan file while the device’s owner is sleeping, get access to their phone, and then delete any evidence the phone was hacked. Once the exploit is completed, a hacker can remotely operate a phone’s microphone, steal files, read emails, and get personal credentials.

“These vulnerabilities are extremely dangerous because they do not require that the victim take any action to be exploited. Unlike spear-phishing, where the victim needs to open a PDF file or a link sent by the attacker, this vulnerability can be triggered while you sleep. Before you wake up, the attacker will remove any signs of the device being compromised and you will continue your day as usual – with a trojaned phone,” says Zimperium chief technology officer Zuk Avraham.

Though Google has applied patches to Android Open Source Project, Zimperium says device owners should be proactive in updating their phones. Android owners can reach out to their telecom providers and device manufacturers to ensure their phones get the update.

Those with Silent Circle’s Blackphone running PrivatOS version 1.1.7 are already protected against the Stagefright vulnerability.

In a statement shared with VentureBeat, Google thanked the lead researcher who found the Stagefright vulnerability, Joshua Drake, and noted that most Android devices have technology in place to deter exploitation. You can read the full comment below.

Comments

Five budget-friendly open source storage servers

Storage is essential for the enterprise: Data must be stored. Data must be retrieved. Data must be shared. Data must be secured. At the same time, storage must not consume the entirety of your IT budget. Fortunately, you can find effective solutions in the world of open source. Outside of cost effectiveness, one of the biggest benefits of these solutions is the ability to modify them to perfectly fit your needs. You can make minor changes or even roll your own storage solution based on one of these tools. If you want enterprise support and a "solution in a can" that will meet just about any enterprise storage need, you should turn to Red Hat or SUSE. Both Linux-based companies offer some of the most powerful enterprise-ready tools on the market. But if you'd rather get your hands dirty and craft something of your own—something that won't demolish your budget—these five open source tools are a great place to start. 1: ownCloud ownCloud ( Figure ...

Facebook Now Supports PGP To Send You Encrypted Emails

You can now instruct Facebook to encrypt every email it sends to you so nobody — not even the NSA — is likely to be able to read your messages anytime soon. All you have to do is import your public PGP key into your Facebook settings and you’re good to go. The problem here, of course, is that most people have no idea how public/private key email encryption works and how to even get started with it. In the wake of Edward Snowden’s leaks, a number of organizations, including Google, promised to completely hide the complexities of end-to-end email encryption from regular users. Very few of these products have materialized so far, however — not for lack of trying, but because this is actually a very complex problem, both from a technical and user experience perspective. Facebook uses the well-established PGP scheme (the GNU Privacy Guard implementation of OpenPGP, to be precise) to encrypt messages and tools lik...

Intel announces the first 14 nanometre processor

At the Computex conference in Taipei, chipmaker Intel has revealed a fanless mobile PC reference design using the first of its next-generation 14nm "Broadwell" processors. The 2 in 1 pictured here is a 12.5" screen that is just 7.2 mm thick with keyboard detached and weighs 670 grams. The Surface Pro 3 – for comparison – is 9.1 mm thick and weighs 800 grams. It includes a media dock that provides additional cooling for a burst of performance. The next-generation chip is purpose-built for 2 in 1s and will hit the market later in 2014 . Called the Intel Core M, it will be the most energy-efficient Intel Core processor in the company's history with power usage cut by up to 45 percent, resulting in 60 percent less heat. The majority of designs based on this new chip are expected to be fanless, with up to 32 hours of battery life, offering both a lightning-fast tablet and razor-thin laptop. Intel is also delivering innovation and performance for the ...

Use Cortana to define words for you in Windows 10

Microsoft’s Cortana has many uses including sending emails or checking the weather. One of the best uses though is a simple look-up feature for words and their definitions. Combined with the Hey Cortana voice recognition using Cortana to tell you quickly what a word means is a great hands-free tip. There are multiple ways to get Cortana to define a word. If you have Hey Cortana enabled you can simply blurt out your request: “Hey Cortana what is the meaning/definition of inchoate ?” “Hey Cortana define ubiquitously “ You can, of course, also just type in your request e.g “ define beatitude ” although this admittedly takes some of the speed (and fun) out of using the personal digital assistant. For many words, Cortana displays the definition within a card, and OxfordDictionaries or EncartaDictionaries powers it. Sometimes, if Cortana misunderstands you or does not have the definition, the assistant opens up a web page after performing a web search for...

Kodak Is Bringing Back Super 8

If you’ve always wanted to shoot video using the tools your parents probably used to film each other naked then Yves Behar and Kodak have a product for you. Super 8 was a cartridge-based film standard that became surprisingly popular after its release in 1965. It has remained popular with vintage film buffs and now Eastman Kodak is working on a $400 to $750 Super 8 camera for the modern auteur. Behars designed the camera to look retro and boxy while cleaving to a more material design aesthetic. The problem? Film is hard to get these days and even with the support of a Super 8 subculture it will be hard to see just who is going to produce this stuff profitably. Heck, the WSJ expects it to cost $50 just to process the stuff. However stranger things have happened – Holga, for example – and the market is a strange mistress. “This is no longer the classic script of a war of digital versus analog,” Kodak CEO Jeff Clarke. “What it really is now is the co...

Exciting Technology

Search This Blog