Stagefrightening

The recently reported Android Stagefright vulnerability is certainly scary sounding. But, as with many vulnerability reports these days, there is something of a lack of detailed information—though plenty of hype. Evidently more details will become available after a presentation at Black Hat USA on August 5.

The vulnerability was announced on the Zimperium Mobile Security blog on July 27. The company found a number of flaws in the user-space Android Stagefright media framework that could lead to remote code execution. The flaws have been present since Android 2.2 ("Froyo"), which was released in May 2010. That means there are roughly a billion devices potentially vulnerable to the flaws.

According to the announcement, one of the nastier vectors for exploiting the vulnerability is through Multimedia Messaging Service (MMS) messages sent to a device. In many cases, just knowing the phone number is enough for an attacker to trigger the flaw—without any user action required. In fact, in some cases, the actual message can be deleted by the attack, so the only indication of an attack is in a notification message or the received-message logs.

Based on some CyanogenMod commits by Zimperium zLabs VP of Platform Research and Exploitation Joshua J. Drake (also known as "jduck"), the flaws are mostly integer overflow and underflow bugs in Stagefright. A Threatpost article indicates that fuzzing was used to find at least some of the flaws.

The bugs have been fixed in the Android open-source code and incorporated into updates for CyanogenMod, Firefox for Android (which uses Stagefright), and the Blackphone from Silent Circle. But the vast majority of Android devices have yet to see an over-the-air update to fix the problems. That likely puts a lot of phones at risk.

In fact, there are serious questions about whether older phones will even get updates. Given that the patches are public, it would seem only a matter of time before attacks are mounted using the flaws. Between now and whenever carriers and manufacturers decide to put out an update (if they ever do), most Android phone users will be vulnerable.

There is one mitigation technique that may help: turning off auto-loading of MMS messages. In many texting applications (and Google Hangouts, which is also affected), there are settings to turn off this convenience feature. Older phones, though, tend not to have those settings. But even if auto-loading is disabled, users will have to make a difficult decision when they receive an MMS message—the safest option is to never load it, which may be less than desirable from a few angles.

Part of the reason that this vulnerability is so dangerous is because Stagefright is evidently overly privileged in many Android devices. That means that compromising Stagefright allows the attacker to do many things that would be restricted for components with lesser privileges. According to Drake in the Threatpost article, that includes monitoring communications, using the internet, and other "nasty things". He speculated that some of that access might be required to be able to support various digital rights management (DRM) schemes.

It would appear that all unpatched Android devices (2.2 and newer) are vulnerable, though it is a little hard to tell. So far at least, there doesn't seem to be a test to determine whether a given device is vulnerable. It's also difficult to be sure just how Stagefright is used on a given device. Obviously not performing multimedia playback from untrusted sources (which is not a bad policy in any case) should avoid the bugs but, as the MMS auto-loading shows, it is not always clear when and how Stagefright code is being invoked.

Even though the fixes are public, the scope of the problem is still a bit murky. Screen shots from the blog post show a proof-of-concept attack against Android 5.1.1 ("Lollipop"), but are widespread attacks against multiple Android versions possible? One would guess they are, but we probably won't know more until after Black Hat. It has become something of an annual rite of (northern hemisphere) summer to see hyped security vulnerabilities ahead of the conference. Sometimes they turn out to be worse than early indications—and sometimes the actual exploitability doesn't live up to the hype.

If this is the "big one" that researchers have been predicting for Android for some time—as it certainly appears to be—it will be interesting to see how the ecosystem reacts. How much effort will carriers and handset makers expend to patch the problems for users of years-old devices? Given that many of those devices already have serious, known flaws that have yet to be fixed, there is little reason to believe the reaction to Stagefright will be all that much different. Eventually, though, that cavalier attitude toward serious security holes in customers' phones may well come back to bite Android and its ecosystem.