Researchers find vulnerability that affects 95% of Android devices

Image Credit: Google

Update: This article has been updated with a comment from Google.

Researchers have found a vulnerability in Android devices that allows hackers to access a device remotely without the owner ever knowing it was compromised. The flaw affects roughly 95 percent of Android devices running operating system version 2.2 to 5.1, according to cybersecurity firm Zimperium.

At fault is a media library (used to process media files) called Stagefright.Zimperium says it found multiple vulnerabilities in the framework. The company plans to present its research at the Black Hat 2015 security conference and at the hacking conference Def Con in August.

Using a person’s telephone number, hackers can send a media file via MMS that gives them entry into a device. What’s more, the owner of the device may never know. Hackers could conceivably send the trojan file while the device’s owner is sleeping, get access to their phone, and then delete any evidence the phone was hacked. Once the exploit is completed, a hacker can remotely operate a phone’s microphone, steal files, read emails, and get personal credentials.

“These vulnerabilities are extremely dangerous because they do not require that the victim take any action to be exploited. Unlike spear-phishing, where the victim needs to open a PDF file or a link sent by the attacker, this vulnerability can be triggered while you sleep. Before you wake up, the attacker will remove any signs of the device being compromised and you will continue your day as usual – with a trojaned phone,” says Zimperium chief technology officer Zuk Avraham.

Though Google has applied patches to Android Open Source Project, Zimperium says device owners should be proactive in updating their phones. Android owners can reach out to their telecom providers and device manufacturers to ensure their phones get the update.

Those with Silent Circle’s Blackphone running PrivatOS version 1.1.7 are already protected against the Stagefright vulnerability.

In a statement shared with VentureBeat, Google thanked the lead researcher who found the Stagefright vulnerability, Joshua Drake, and noted that most Android devices have technology in place to deter exploitation. You can read the full comment below.

Comments

What is your preferred smartphone screen size

Screen envy. We all have it. Or do we? See, that’s the thing, I’m just not so sure. One thing I am sure about is that our phone screens have gotten progressively bigger and bigger over the last few years. The funny thing is, we as a society have taken that ball and run with it, like we just don’t care. But I always thought we did care? Some time ago, when phones were in the sub-5” range, we used to have a term called “phablet” which described an almost absurdly big phone. The definition varied from person to person. I always considered a phone with a screen 5.5” or bigger to be a phablet. The Galaxy Note fell into that category. The Lumia 1520 certainly did. There are others as well. I was safely ensconced in the 4.5” area at the time with my Lumia 920. What did I know? Leon’s getting laaaaaaaarrrger But slowly, phones started topping the 5” mark. I’m not talking about phablets here, I’m talking about normal flagship phones – the Galaxy S4 (barely) and the HTC One (M7) are ...

Airbnb will open its Cuba listings to users outside the United States

Airbnb will now let travelers from outside the U.S. to book properties in Cuba after receiving authorization from the U.S. government, reports the Associated Press . Previously, only Americans were allowed to reserve the site’s Cuban listings . They will open to international users on April 2. Airbnb launched its Cuban operations in April 2014 , four months after the Obama administration revealed that it will begin to restore diplomatic relations with the Communist country . The historic policy change means that travel and trade sanctions will be lifted , which is expected to boost tourism to Cuba dramatically because Americans no longer need licenses to visit. In fact, President Obama is currently on an official visit to Cuba , the first president since Calvin Coolidge to do so. According to the AP, Cuba is currently Airbnb’s fastest-growing market, with about 4,000 homes added since it opened listings. Other travel businesses...

Peel Turns Your Apple Watch Into A Universal Remote Control

Does it make sense to use your Apple Watch as a remote control for your media devices? Smart remote maker Peel thinks so, having just launched a universal remote control application for the Apple Watch which lets you operate over 400,000 models of home electronics, including not only televisions, but also DVD players, and even audio and streaming devices, like the Roku. The Apple Watch app is actually an extension of the company’s existing smart remote app for iPhone . And while in a few cases the new Watch app will allow you to control your devices via Wi-Fi, for the most part, it will require the Pronto hardware just like the iPhone version does. The Pronto 360-degree IR blaster is what turns the iPhone, and now the Apple Watch, into a smart universal remote control. A $49.99 piece of hardware about the size of a salt shaker, Pronto sits in your entertainment center to provide the IR capabilities required to operate your TV and other electroni...

Facebook Now Supports PGP To Send You Encrypted Emails

You can now instruct Facebook to encrypt every email it sends to you so nobody — not even the NSA — is likely to be able to read your messages anytime soon. All you have to do is import your public PGP key into your Facebook settings and you’re good to go. The problem here, of course, is that most people have no idea how public/private key email encryption works and how to even get started with it. In the wake of Edward Snowden’s leaks, a number of organizations, including Google, promised to completely hide the complexities of end-to-end email encryption from regular users. Very few of these products have materialized so far, however — not for lack of trying, but because this is actually a very complex problem, both from a technical and user experience perspective. Facebook uses the well-established PGP scheme (the GNU Privacy Guard implementation of OpenPGP, to be precise) to encrypt messages and tools lik...

eGym raises $45M Series C for cloud-connected gym equipment and fitness software

eGym , the Munich-based startup that offers cloud-connected gym equipment and supporting cloud software and app for the fitness training floor, has closed $45 million in Series C funding. The round was led by new investor HPE Growth Capital, while existing investors, including Highland Europe, also participated. The problem that eGym is looking to solve is that, whilst gyms have moved from a bodybuilder market to a mass market in the last 20 years, the technology in gyms lags behind. That’s despite the fact that better use of technology can help to reduce customer churn, the biggest pain-point of both gym operator and gym users. Comprising of an app for both gym user and trainer, combined with the company’s connected strength machines, the eGym Cloud makes it possible for gym members to receive better fitness instruction and an evolving and personalised fitness plan based on data collected as they workout. And by providing a better workout feedback loop, gym goers can get an i...

Exciting Technology

Search This Blog