Android OS vulnerability can lead to infection billion devices
Discovered by researchers vulnerability threatens almost all owners of devices on Android. The number of potentially contaminated smartphones and tablets could exceed one billion.
Experts have called this vulnerability most serious in the history of the operating system, because it is potentially available to 95% of all devices on Android. This particular device for breaking attackers enough to have a phone number of the victim. They are sent via MMS video which carries the harmful code. Since the vulnerability is in the normal Android tool for playback of multimedia files called Stage fright, attackers when playing videos are able to infiltrate into the system.
It is noteworthy that with the English «stage fright» translated as "stage fright."Starting with Android 4.1 Google has added the so-called sandbox, which are performed absolutely all processes, including the work of system applications. This was done to prevent the impact of applications on the system files, but with the help of this vulnerability is now virus may still leave the "sandbox." The only not subject to this vulnerability devices on Android - is the system of smart phones version 2.2 and below. However, in April of smartphones it was only 0.4% of all employed.
Detect the problem was a specialist company Zimperium zLabs Joshua Drake. According to him (them leads Forbes ), his finding specialists notified by Google in April this year and the company has already sent to all producers the necessary corrections in the source code. But Drake was confident that few manufacturers applied these fixes in their firmware.
According to his calculations, now in the world about 950 million devices on Android, which can be infected this way.
Google rewarded me, 337 for these patches. That's after I talked them up from, 000.Now Android has a VRP! - Joshua J. Drake (jduck) July 27, 2015
Details of the vulnerability Zimperium plans to open at BlackHat 2015 that will take place in the first days of August in Las Vegas. The main danger lies in the hole that the victim does not even know about the infection: the virus immediately removes the smartphone received MMS-message, and the user does not see it. Moreover, some smartphones virus does not appear in the pop-up notification time and thus the system is totally unnoticed.
In some smartphones, for example Samsung Galaxy S4, the thus obtained virus gets the same level of access to the software that processes and systems that allow an attacker to have almost complete control over the device.
However, in general, according to Drake, the consequences from breaking is not so serious: many smartphones with Android 4.1 Jelly Bean and more viruses, access the system through Stage fright, do not have the same rights as system applications. But this is enough for them to the attacker was able to get data from your smartphone victim.
In particular, Drake said that the Nexus 6, the latest version of the software is protected from viruses that spread on such a scheme, but it is not all: patches for some of them just do not have time to Google add to the system. In turn, to HTC announced that the delivery of appropriate corrections began in July. However, it should be understood that not all manufacturers of smartphones on Android will be able to immediately prepare an update for their devices.
To understand: Android 5.0 Lollipop, published in November 2014, is now installed only on 12% of all devices on the system. It's not that people do not want to put it, but that manufacturers still do not release an update for smartphones.
One way to get rid of self-potential threat is to obtain root-rights and manual shutdown or delete Stagefright. In this case, the malicious code will not be able to start. Moreover, SMS-application setting can disable the automatic loading of MMS-messages. However, these temporary solutions and also limit the functionality of your smartphone. For this reason, a patch that blocks the ability to run Virus by Stagefright, must be installed as soon as possible.
In particular, Drake said that the Nexus 6, the latest version of the software is protected from viruses that spread on such a scheme, but it is not all: patches for some of them just do not have time to Google add to the system. In turn, to HTC announced that the delivery of appropriate corrections began in July. However, it should be understood that not all manufacturers of smartphones on Android will be able to immediately prepare an update for their devices.
To understand: Android 5.0 Lollipop, published in November 2014, is now installed only on 12% of all devices on the system. It's not that people do not want to put it, but that manufacturers still do not release an update for smartphones.
One way to get rid of self-potential threat is to obtain root-rights and manual shutdown or delete Stagefright. In this case, the malicious code will not be able to start. Moreover, SMS-application setting can disable the automatic loading of MMS-messages. However, these temporary solutions and also limit the functionality of your smartphone. For this reason, a patch that blocks the ability to run Virus by Stagefright, must be installed as soon as possible.
Post A Comment:
0 comments: