4 ms·

The update strategy has been rethought and, frankly, I'd be surprised if anyone needs to release an OS update to fix this. Google clearly can and will just upda

by fpgeek 11y ago

The update strategy has been rethought and, frankly, I'd be surprised if anyone needs to release an OS update to fix this. Google clearly can and will just update the Hangouts app (if they haven't already). I'd expect most other manufacturers to just put an update for their OEM messaging app on the Play Store (if they don't already have a hook in something like an updateable OEM framework app they can use).

shkkmo 11y ago
> But Adrian Ludwig, the lead engineer for Android Security, told NPR the flaw ranks as "high" in their hierarchy of severity; and they've notified partners and already sent a fix to the smartphone makers who use Android. It sounds like the fix can't be (or isn't being) made in the hangouts app.
shawn-butler 11y ago
It isn't an Hangouts app issue, that is just a one attack vector. It is/was an issue in Stagefright. Details of CVE-2015-1538, CVE-2015-1539, CVE-2015-3824, CVE-2015-3826, CVE-2015-3827, CVE-2015-3828, CVE-2015-3829 probably available soon?
- fpgeek 11y ago
  So the Hangouts bit is just about triggering the problem without user intervention? If an attacker can find another way to get you to play a malicious video, there's still a hole? That's clearly more serious.
  - stormcrowsx 11y ago
    It just requires opening the video. The average user will probably open a video from an unknown sender without thinking twice because why would a video message hack their phone. I would imagine given that it controls phones it would also be possible to make a worm from this that resends the video to everyone in the contact list.
    - fluidcruft 11y ago
      What about video in browser? It seems like video is replacing gif everywhere and those autoplay. I've seen websites that have video as backgrounds. Wouldn't stagefright handle those videos also?
    - hraedon 11y ago
      From the article, it sounds like they only need to open the text message: they don't need to actually play the video, even in the stock MMS app. In my experience, people will open a message just to clear the notification and that's all that it would take for them to be compromised.
- deleted 11y ago
  [deleted]

by fpgeek 11y ago

shkkmo 11y ago

> But Adrian Ludwig, the lead engineer for Android Security, told NPR the flaw ranks as "high" in their hierarchy of severity; and they've notified partners and already sent a fix to the smartphone makers who use Android. It sounds like the fix can't be (or isn't being) made in the hangouts app.

shawn-butler 11y ago

It isn't an Hangouts app issue, that is just a one attack vector. It is/was an issue in Stagefright. Details of CVE-2015-1538, CVE-2015-1539, CVE-2015-3824, CVE-2015-3826, CVE-2015-3827, CVE-2015-3828, CVE-2015-3829 probably available soon?

fpgeek 11y ago
So the Hangouts bit is just about triggering the problem without user intervention? If an attacker can find another way to get you to play a malicious video, there's still a hole? That's clearly more serious.
- stormcrowsx 11y ago
  It just requires opening the video. The average user will probably open a video from an unknown sender without thinking twice because why would a video message hack their phone. I would imagine given that it controls phones it would also be possible to make a worm from this that resends the video to everyone in the contact list.
  - fluidcruft 11y ago
    What about video in browser? It seems like video is replacing gif everywhere and those autoplay. I've seen websites that have video as backgrounds. Wouldn't stagefright handle those videos also?
  - hraedon 11y ago
    From the article, it sounds like they only need to open the text message: they don't need to actually play the video, even in the stock MMS app. In my experience, people will open a message just to clear the notification and that's all that it would take for them to be compromised.
deleted 11y ago
[deleted]