Discovered by researchers vulnerability threatens almost all owners of devices on Android. The number of potentially contaminated smartphones and tablets could exceed one billion.
Experts have called this vulnerability the most serious in the history of the operating system, because it is potentially available to 95% of all devices Android. This particular device for breaking attackers enough to have a phone number of the victim. They are sent via MMS video which carries the harmful code. Since the vulnerability is in the normal Android tool for playback of multimedia files called Stagefright, attackers when playing videos are able to infiltrate into the system.
It is noteworthy that with the English «stage fright» translates as “stage fright».
Starting with Android 4.1 Google has added the so-called sandbox, which are carried out completely all the processes including the work of system applications. This was done to prevent the impact of applications on the system files, but with the help of this vulnerability is now virus may still leave the “sandbox.” The only not subject to this vulnerability devices on Android – is the system of smart phones version 2.2 and below. However, in April of smartphones it was only 0.4% of all employed.
To find out the problem was a specialist company Zimperium zLabs Joshua Drake. According to him (their causes Forbes ), their discovery experts informed Google in April this year and the company has already sent to all producers the necessary corrections in the source code. But Drake was confident that few manufacturers applied these fixes in their firmware.
According to his estimates, today there are about 950 million devices on Android, which can infect the way.
Details of the vulnerability Zimperium plans to open at BlackHat 2015 that will take place in the first days of August in Las Vegas. The main danger lies in the hole that the victim does not even know about the infection: the virus immediately removes the smartphone received MMS-message, and the user does not see it. Moreover, some smartphones virus does not appear in the pop-up notification, and instant thus the system is totally unnoticed.
Some smartphones, such as Samsung Galaxy S4, the thus obtained virus gets the same level of access to the software that processes and systems that could allow an attacker to have almost complete control over the device.
However, in general, according to Drake, the consequences from breaking is not so serious: many smartphones with Android 4.1 Jelly Bean and more viruses, access the system through Stagefright, do not have the same rights as system applications . But this is enough for them to the attacker was able to get the data from your smartphone victim.
In particular, Drake said that the Nexus 6, the latest version of the software is protected from viruses that spread on such a scheme, but it is not all: patches for some of them just do not have time to Google add to the system. In turn, in HTC announced that the delivery of appropriate corrections began in July.
However, it is understood that not all manufacturers Android smartphone will be able to immediately prepare an update for their devices.
In order to understand: Android 5.0 Lollipop, published in November 2014, is now installed only on 12% of all devices on the system . It’s not that people do not want to put it, but that manufacturers still do not release an update for smartphones.
One of the ways of self-deliverance from potential threats is to obtain a root-rights and manually disable or delete Stagefright. In this case, the malicious code will not be able to start. Moreover, SMS-configured application can disable the automatic loading of MMS-messages. However, these temporary solutions and also limit the functionality of your smartphone. For this reason, a patch that blocks the ability to run Virus through Stagefright, should be installed as soon as possible. 
No comments:
Post a Comment