3 ms·
> Drake speculates that Stagefright has its excessive permissions and Internet access to satisfy some types of digital rights management processing or streaming
by guelo 11y ago
> Drake speculates that Stagefright has its excessive permissions and Internet access to satisfy some types of digital rights management processing or streaming playback.
Goddamn you Hollywood.
- higherpurpose 11y agoLet's not forget the companies that not just caved to Hollywood, but actively promoted their ideas at W3C and so on (see EME, etc). They share the blame, too. They can't all just throw their hands up in the air and say "they made us do it".
- bcg1 11y agoConsidering that perspective, the irony of the name "Stagefright" is not lost.
- Jehops 11y agoI don't see any mention of Stagefright in the article.
- guelo 11y agoLooks like the moderators switched out the article. It used to point to this one https://threatpost.com/android-stagefright-flaws-put-950-million-devices-at-risk/113960 https://threatpost.com/android-stagefright-flaws-put-950-mil...
- acqq 11y ago"The problem is that Stagefright is an over-privileged application with system access on some devices, which enables privileges similar to apps with root access. Stagefright is used to process a number of common media formats, and it’s implemented in native C++ code, making it simpler to exploit This is huge.
- deleted 11y ago[deleted]
- ajross 11y agoIt's a little confused. Stagefright is just a library containing the exploit. The component being (presumably) exploited is the mediaserver process. This is where almost all video decode/encode handling happens in Android (and other related stuff, like audio and camera). And yes, the mediaserver has internet access so that it can fetch and decode streams on its own without forcing all I/O to go through a user process. Basically it's a performance optimization, though indeed probably one necessitated by having to wall off all that DRM handling in the first place. That said, mediaserver, while it has lots of access to things that Android apps don't (e.g. open file descriptors to kernel vendor-specific drivers with lets-just-say-questionable security practices), is not a root process. And it's reasonably sandboxed in recent Android versions using selinux. An exploit into it may not be quite as device-cracking as is being claimed. Still, not a good thing at all.
- Florin_Andrei 11y ago> And it's reasonably sandboxed in recent Android versions using selinux. Is it safe to assume that this attack vector is not a concern with Android 5.1? (or later)
- ajross 11y agoCertainly not, because the plausible kernel bugs in those open driver descriptors (I'm serious: vendor media drivers are not pretty things) would obviously not be subject to selinux controls. But at least there is some sandboxing in place; the security architecture was designed to admit the possibility of a breach of the mediaserver.
- fluidcruft 11y agoAccording to the reddit discussion, 5.1.1 is demonstrated to be vulnerable (so it affects everything 2.2 and later).
- ajross 11y agoLink to that reddit thread? AFAICT, all current claims are for a crash exploit into libstagefright, not a breakout of the mediaserver to (for example) persistently write a payload/rootkit.