New Major Android Attack Vector: MMS Videos

[Srgnt_Ballistic]

Image Source: Android Central

 

Source: Engadget
 
Original Source: NPR
 
Zimperium security researchers announced a new exploit which lets attackers control android devices remotely by simply sending unsuspecting victims and MMS video. Said video contains a malware payload which stealthily takes control of the receiving device. Attackers could technically send the MMS to completely random cell phone numbers.

The scariest thing about this is that a user doesn't even have to acknowledge or open the message to fall victim to the exploit. This is because it can be triggered via pre-processing by messaging apps such as Google Hangouts. Other messaging apps that don't utilize this initial processing are still susceptible to the attack if the message is opened, but it's obviously much easier to avoid in this case. Just don't open MMS messages from unknown or untrusted numbers.

To be clear in either case the victim does not have to playback the video for their device to be "owned". Simply receiving it via Hangouts or viewing it with other messenger apps is enough to trigger the exploit.

 The shear number of devices affected by this exploit makes this a pretty serious security flaw. The researchers that have found this new attack vector have submitted their findings to google and received confirmation that they have accepted all of his recommended patches.

 

Image Source: Techno Buffalo

 

 

Unfortunately it's not as simple as Google rolling out a patched APK for Hangouts. The fragmentation in the Android market place rears it's ugly head here. Even though this ranks very high on Google's severity meter, the fix has to be done at a manufacturer level and rolled out to users. It's out of Google's hands now that they have passed the fix on to partners.

Add Carriers to the mix and the percentage of devices that will actually receive a fix could be as low as 50%. And that's being optimistic.

Below is an interesting, if not undecipherable infographic which helps to visualize the Android update process. It's much more complicated than say for iPhone. Apple maintains extremely strict control of their entire ecosystem (hardware and software), meaning they can push updates much quicker and with certainty that a high percentage of end users with be running the most up-to-date version of the OS.

So is this as bad of a security flaw as some sources are making it out to be? The researchers say they don't think hackers are using it in the wild yet. But what if this wasn't actually a 0-day discovery? How many owned Android devices are out there at the moment?
 

Image Source: Droid-Life

[WereCat]

Dang it I am too late. I just wanted to post this

This kind of security error is a big facepalm in my opinion. How the heck did not someone patched it already especially if it is there since 2.2 version. Also gg older Android phones users.

I mean... 95% Android phones have this vulnerability while 50% of them can be root accessed and in the others attacker can get control over camera, mix, ..etc.

[swifty7]

screw android,  I'll stick with ios forever.

[SirSquid]

screw android, I'll stick with ios forever.

Don't act like IOS doesn't have exploites, may I remind you of the xara exploit that was found last month.

[Kurosaki Isshin]

mom does all her banking on the phone. what a mess! lol!

[Tataffe]

Don't act like IOS doesn't have exploites, may I remind you of the xara exploit that was found last month.

 

And will probably be fixed on all devices soon, if it hasn't been already ...

[RH00D]

This is why the only smartphones I'll own will be Windows or iOS based. (Haven't gone to iOS yet though!)

 

There's some phenomenal hardware in Android phones but its not worth the horrid performance, security, and update process.

 

Edit: and its not about Android having security vulnerabilities, as all OS gets them. It's the fact that with Android your chances of getting a patch/update are incredibly slim.

 

Edit again: As the poster below me mentioned I would also consider BlackBerry as well. BB Passport has been getting awesome reviews.

[Briggsy]

It's crap like this that almost makes me want to switch back to blackberry... almost. I'd probably switch to a windows phone before that, possibly even apple and their horrid battery life.

[NinerL]

That's why I always recommend iOS to family and friends, I've never seen a serious iOS exploit that can be abused with such ease.

[Techhog]

So, serious question for you guys: Do most of you think that open source allowing OEM customization simply doesn't work for the mobile space as-is and that Google should make future versions of Android locked down, closed-source, a universal featureset, and with specific hardware requirements  to gain control of updates? That seems like it would be a consensus here.

[samcool55]

I can't receive mms messages because some APN or whatever isn't configured properly, seems like it's going to stay that way.

[cesrai]

So, serious question for you guys: Do most of you think that open source simply doesn't work for the mobile space as-is and that Google should make future versions of Android locked down, closed-source, and with specific hardware requirements to gain control of updates? That seems like it would be a consensus here.

Well, Android is open source but if you're going to use Google services then it isn't open source anymore.

[iamdarkyoshi]

screw android,  I'll stick with ios forever.

although not exactly a hack, I found an bug that allowed you to reboot an iPhone 4 with a simple text message. I had used gmail mobile on my dsi for years to text and there was a certain character that caused the phone to completely crash for whatever reason. Don't remember what it was though.

[qwertywarrior]

so wait

is it a hangouts issue or not

i already have it uninstalled

[Srgnt_Ballistic]

so wait

is it a hangouts issue or not

i already have it uninstalled

Hangouts does pre-processing on Video MMS. So if sent this exploit the target device can be controlled even if the user doesn't view or open the message.

With other messaging apps like the "stock" Messenger, no pre-processing is done but target devices can still be exploited if the user opens the MMS.

Google (Android) could potentially patch Hangouts to not do any pre-processing but the threat is still there if someone were to view the message (not the video just the message) on a target device.

[Techhog]

Well, Android is open source but if you're going to use Google services then it isn't open source anymore.

Stop talking in technicalities and answer the question. Should Android be locked down so Google has complete control of updates and optimization as the expense of customization and special features?

[cesrai]

Stop talking in technicalities and answer the question. Should Android be locked down so Google has complete control of updates and optimization as the expense of customization and special features?

Well yes and no.

Yes, because if it did, the quality control will be higer, security will be better, the epxrince will be similar across devices ( kinda ).

No, because it being open source is reason a lot of vendors using it and if they stop then that's bad for Google so I don't think that will ever happen.

But imho nope don't do it, leave it as it is.

And Google has great I fluwence I mean just look at their nexus deviecs, they got rid of microsd and introduced on screen home buttons.

[WereCat]

I can't receive mms messages because some APN or whatever isn't configured properly, seems like it's going to stay that way.

You are still vulnerable as such malicious video content may also be triggered trough the web. MMS is more dangerous because attacker just needs your phone number and on the web you have to stumble upon it. It just doesn't mean you can't be attacked.

[samcool55]

You are still vulnerable as such malicious video content may also be triggered trough the web. MMS is more dangerous because attacker just needs your phone number and on the web you have to stumble upon it. It just doesn't mean you can't be attacked.

True, but i only watch video's on youtube and twitch, so i think i will be fine

At least i hope so... It does sound quite scary D:

[beebskadoo]

Just disable auto retrieve for MMS messages, easy temporary solution to the problem.

Also Google does recommend using Messenger for SMS instead of Hangouts.

 

This should be patched soon

[GoodBytes]

Just disable auto retrieve for MMS messages, easy temporary solution to the problem.

Also Google does recommend using Messenger for SMS instead of Hangouts.

 

This should be patched soon

The security issue can be distributed via an infected website and video.

[beebskadoo]

The security issue can be distributed via an infected website and video.

Where did it say that? AFAIK it's only in MMS video

[BuckGup]

Better my point all phones suck in one or more ways. There is no perfect phone at this moment or in the near future. Some might benefit in one area but get destroyed in one or both plus they are way too expensive!

[GoodBytes]

Where did it say that? AFAIK it's only in MMS video

The news I reported by was a repost

http://www.neowin.net/news/major-android-security-flaw-leaves-950-million-phones-vulnerable-to-being-silently-hacked

[beebskadoo]

The news I reported by was a repost

http://www.neowin.net/news/major-android-security-flaw-leaves-950-million-phones-vulnerable-to-being-silently-hacked

So basically Google has already patched it but it's up to OEMs to implement the patch?

 

Good luck Samsung lovers <3

 

This is why I have a Nexus phone