Android Stagefright Exploit leaves 80% of Android Devices Vulnerable to Remote Code Execution
Android’s infamous Stagefright exploit has had proof-of-concept exploit code released to the public – meaning that 80% of Android devices are now vulnerable to malicious code execution by remote hackers. While the exploit doesn’t work on Android devices running KitKat or newer, the majority of devices are still running Android 4.4 or older. Stagefright (a collection of bugs in one of Android’s media libraries) allows malicious hackers to execute code simply by having users “browse to a malicious webpage or open a booby-trapped MMS in an unpatched messaging app”, which can be used “to take photos and capture audio from the microphone without a user’s knowledge” (Techspot). This is an extremely potent hack, as it is relatively easy to exploit and has basically unlimited potential. Unfortunately, Android devices’ firmware is rarely updated (if ever) as they cannot simply be patched by Google but must go through a long process of approval and adjustment by OEMs for each individual phone model before being pushed out to end-users. As such, devices that are several years old are unlikely to have this exploit patched.
Computer malware is one of the best examples of networks and networking concepts – since they often use computer networks to spread. A user may for example open a non-malicious looking email which directs them to a malicious webpage, which uses the stagefright vulnerability to inject malicious code into the user’s device. This malicious code can be anything from an annoyance to malware that takes over the user’s phone as part of a “botnet” and begins distributing malicious emails and malware to other people’s devices. Through computer networks, the phone has the potential to attempt attacks on virtually any internet connected device worldwide, spreading malware through computer connections in much the same way as germs spread through human connections. Malware could even emulate the concept of strong and weak ties, where the strength of the tie is the level of access a device has into a particular system. For example, any malware would be much more likely to wreak havoc when users store SSH keys, passwords, or other credentials on their devices. Any malware could easily harvest this information and gain access to other privileged systems, causing more damage in the owner’s ecosystem than they thought possible (simulating increased chances of spread via stronger network ties).
Sources:
http://www.tomshardware.com/news/android-stagefright-exploit-publicly-released,30056.html
http://www.techspot.com/news/62061-code-exploiting-android-stagefright-vulnerability-now-wild.html