A Word Of Fear For Android Devices

You can get an idea about StrageFright 1.0 from the following link: Avast blog for StageFright 1.0

StageFright 2.0

According to Zimperium, a pair of recently discovered vulnerabilities make it possible for an hacker or attacker to get into Android device with an MP3 or MP4 like file, so when the metadata for that file is previewed by the OS that file could execute malicious code via the website or a human being. In the middle of an attack it is built specifically for delivering these malformed files, this code could be executed without the user interaction. “Zimperium claims to have confirmed remote execution and brought this to Google's attention on August 15. In response, Google assigned CVE-2015-3876 and CVE-2015-6602 to the pair of reported issues and started working on a fix.” Is your Android device vulnerable for StageFright 2.0 According to Zimperium “In one way or another, yes. CVE-2015-6602 refers to a vulnerability in libutils, and as Zimperium points out in their post announcing the discovery of this vulnerability it impacts every Android phone and tablet going back as far as Android 1.0. CVE-2015-3876 affects every Android 5.0 and higher phone or tablet, and could theoretically be delivered via a website or man in the middle attack.”

What CVE is?

I am talking about CVE but what actually CVE is? CVE stands for Common Vulnerabilities and Exposures (CVE) system provides a reference-method for publicly known information-security vulnerabilities and exposures. CVE-ID Syntax There was an old version of CVE syntax also which is a little bit different from the below-defined syntax. CVE prefix + Year + Arbitrary Digits [ New syntax implemented from Jan 1st, 2014 ] So if someone says what is CVE-2015-6602, then we can easily describe it, that it is a threat ( Common Vulnerability Exposure ) which came in the year 2015 having CVE-ID 6602. By putting CVE-2015-6602 on the website: www.cvedetails.com you can get more information, resources and links for the particular CVE. I hope that now CVE-YYYY-NNNN is not a new thing for you. You are aware and you can answer if someone asks. The following figure is clearly showing the difference between old CVE syntax and new CVE syntax. Image Source- mitre.org

How to know my Android device is affected by StageFright 2.0 vulnerability?

Zimperium launched a tool StageFright Detector which tells us about StageFright vulnerability for our android device. You download their app from Google Play Store.

How to fight with StageFright 2.0 until the patch arrives?

OS which has fixed StageFright 2.0

Blackphone 2, is a smartphone in which the phone is encrypted for tightening the security. The company named it Silent OS which is also made from an Android open source.

Cyanogenmod OS have patched for StageFright 2.0

I am surprised what Google is doing, is Google seriously doing something to secure their OS like iPhone. iOS is much more secure than Android. iOS released updates in a timely fashion to make it secure and for better performance and keeping eye on their store. I read the news 10-20 days ago that a Chinese app in iOS was trying to do getting information. Apple quickly blocked that app from its store. This is called a secure environment with quick action.

Wrap Up

Although the android device covered more than 83% market globally if security issues will go on continuously people will lose their interest in the android device. Billions of Android devices are at risk. Privacy is also at risk. StageFright attacker can get access to your android device at root level and can do anything. Let’s see what will happen in the coming months. Hoping better future for android devices in terms of security. Happy reading. Please share your views via comments.