5 ms·
Any competent malware developer must have already figured out how to exploit this the first time around. Now that every single one of those malware developers h
by stevenh 11y ago
Any competent malware developer must have already figured out how to exploit this the first time around. Now that every single one of those malware developers has learned it is still exploitable, the payload they've spent the past month perfecting can now be deployed in the wild.
So, can someone explain why a disastrous worm hasn't already swept the globe and infected 99% of Android devices on the planet within ten minutes of being released in the wild?
1. Text payload to victim
2. Payload executes on victim's phone and texts itself to all of the victim's contacts
3. Repeat
Assuming the average Android phone owner has 20 contacts who also have Android phones, and assuming also that texting the payload to those 20 people would take two minutes to complete, the infection would spread exponentially and only take ten minutes for the initial text to result in the infection of 10 billion devices worldwide.
Why am I not currently being bombarded with MMS video texts from infected devices? It frankly seems a bit miraculous. Did Google set up an emergency arrangement with all of the carriers to block suspicious video texts so this wouldn't happen?
- danielweber 11y ago1. Maybe it's not as easy as you think. 2. The MMS system isn't as anonymous as the Internet and someone didn't want to burn an identity making this worm. 3. A combination of 1 and 2, where the people with technical skill to do this would only use it on specific targets.
- guelo 11y agoBecause, despite the hype, the bug doesn't give full root access to the phone.
- mike_hearn 11y agoApparently the exploit doesn't work on devices that have good ASLR (based on a /. comment by someone who works on the Android security team).
- m3rc 11y agoDidn't a number of texting apps, possibly including hangouts, update to fix it separate of this botched fix? EDIT: I just checked and sure enough my texting app, QKSMS, updated to remove the Stagefright library
- bitmapbrother 11y agoNo, apps cannot remove system libraries responsible for processing video. What your MMS app did was disable the auto-retrieval of MMS messages.
- moezb 11y agoIt can't remove the system libraries, but it can decide not to use them. Yes, this means if you were to open it with any app that isn't protected then you will still be vulnerable, but within the app you're safe. Source: I wrote QKSMS
- m3rc 11y agoUh no, it disable the stagefright library... disabling MMS auto-retrial is something else that I also did, but QKSMS also removed the ability for the app to interface with the Stagefright Libraries
- djb_hackernews 11y agoFrom what I've read, and could be wrong, is you could be infected and not even know it. The attacker has the opportunity to "clean up" the MMS so you never even get a notification because the bug is before any of that kicks in.
- bentcorner 11y agoStill, we'd see a bunch of reports from non-Android phones receiving MMS's from infected Android contacts.
- qu4z-2 11y agoI've received an MMS unexpectedly from one of my contacts. (I'm on Android)
- ryandvm 11y agoIt's not often that Android's fragmentation is touted as a benefit, but the fact that Android isn't a monoculture is certainly one of the hurdles to developing a worm capable of mass deployment. Supposedly the varying implementations of the Android media services mean a libstragefright exploit may or may not end up with root access. Now, if this were an iOS zero-day exploit... [Actually, it'd be trivial for the carriers to filter the payload, so I don't reckon SMS/MMS is ever going to be a viable transmission vector.]
- nissehulth 11y agoYes, I believe the payload have to be tailored pretty much exclusively for each type of device. But, I doubt that would stop anyone trying. Company phones are often the same type and model, someone with a certain target in mind could probably put in the hours.
- pokpokpok 11y agodo carriers already have a mechanic in place to trigger precautions a message matching worm-like patterns (similarity, mass transmission)? or would they have to implement one after it's too late?
- nissehulth 11y agoI'm afraid carrier don't care enough to do that. I hope I'm wrong.
- acdha 11y agoI suspect the answer is something like this: 1. A worm would be highly visible and easily blocked by carriers 2. There's no easy way to make more money from a mass worm than you could make from lower-profile, more-targeted attacks. You could ask a billion people to send you a dollar but that'd leave a paper trail anyone could follow. 3. The more widespread it is, the more pressure there is on vendors & carriers to ship patches for old devices
- bitmapbrother 11y ago>So, can someone explain why a disastrous worm hasn't already swept the globe and infected 99% of Android devices on the planet within ten minutes of being released in the wild? There are a couple of reasons: 1) Just because you have an exploit it doesn't guarantee you'll be able to execute code because you still need to bypass ASLR. The PoC's released do not do this. 2) Infecting phones with malware is very rare. The "tech pundits" like to scare the public, but the reality is that smartphones are rarely infected. Besides, the people that write and distribute malware are too busy infecting Windows machines.
- NateLawson 11y agoCorrect, most malware infections of mobile devices are targeted attacks for espionage etc.
- dmitrygr 11y agoWith selinux (as most android phones 4.4+ have) I imagine an exploit is not possible.
- NateLawson 11y agoThe carriers are already blocking messages that match this pattern. That's why you haven't seen widespread exploitation. https://twitter.com/jcase/status/628327791713517570 https://twitter.com/jcase/status/628327791713517570 However, this only works in the US when you have 6 carriers. I have no idea what the situation is like elsewhere with massive carrier fragmentation.