Earlier this week, Zimperium (@ZIMPERIUM), the leader in mobile threat protection, unveiled a major vulnerability in Android – Stagefright. Joshua Drake (@jduck), VP of Platform Research and Exploitation and a senior member of Zimperium zLabs, proactively studied the code. According to a few firms, other people have identified vulnerabilities in Stagefright which lead us to believe that this vulnerability and others are actively being exploited in the wild.
Zimperium Mobile Threat Protection customers are safe from this threat, even without updating the device to the latest Android version. If you are concerned that your organization is under MMS attacks – contact us here.
Question: What ability or privileges does this vulnerability provide the attacker?
it is estimated that 50 percent of the affected devices would be able to trigger the vulnerability without any user interaction. For other cases, simply opening the MMS will compromise the device.
During successful attacks, the attacker is able to run arbitrary code on the target device with media or system privileges the audio and camera of the device. Using these privileges, an attacker can perform reconnaissance on their victim by listening in on conversations, and enabling video recording.
On some devices, the affected software runs with “system” privileges. On these devices, the attacker has significantly elevated privileges. On these devices, the attacker has almost full control of the device already.
Apart from these elevated privileges, remote code execution allows sophisticated attackers to execute “privilege escalation” attacks, which allow the attacker to change “roles” on the device – providing unfettered control: access to read the victim’s emails, facebook/whatsapp messages and contacts, access data from other applications or use the device as a pivot into the customers network and cloud applications.
The attacker can hide traces of the attack by simply deleting the infected message after a successful attack. If an attacker spends additional time refining the attack, it can be made silent. In a less sophisticated attack, the victim would see one or more MMS notifications.For failed attack attempts leftover of strange MMS would appear on the device.
Question: How to protect from Stagefright?
We have received a huge volume of request from enterprises asking how to protect from this risk. We are releasing general guidelines that organizations can implement to minimize any exposure to Stagefright.
The Stagefright vulnerability was assigned with the following CVEs:
The following devices are affected:
Protection
Advanced Protection
Zimperium’s advanced mobile threat protection solution – zIPS, is already trained by our core engine z9, to detect and protect from Stagefright. Devices with zIPS activated are fully protected without the need for device update or disabling the MMS.
If you would like to protect your enterprise from any Stagefright threat, or learn more about Zimperium solutions, connect with our team.
Zimperium not only notified Google of this vulnerability, but also provided patches which were implemented within 48 hours. With in-depth understanding of this risk, we will continue to update you on this issue. Stay in touch with Zimperium through our blog or twitter: @ZIMPERIUM.
UPDATE: