57

Digital Trends describes the Stagefright Vulnerability thus:

The exploit in question happens when a hacker sends a MMS message containing a video that includes malware code. What’s most alarming about it is that the victim doesn’t even have to open the message or watch the video in order to activate it. The built-in Hangouts app automatically processes videos and pictures from MMS messages in order to have them ready in the phone’s Gallery app.

How is it that a video file that hasn't been 'played' yet can be used to execute malicious code? Would anyone be able to give a more low-level explanation of how this is possible?

P.S.: To protect yourself just make sure to disable all the 'Auto-Download' features for MMS in your messaging apps (Hangout, Messaging, etc.).

Improve this question
4
  • I guess you are right, I was just surprised that this is such a wide-ranging exploit, yet barely anyone knows how it works...
    – PositriesElectron
    Jul 28, 2015 at 14:02
  • 2
    Certain apps such as Google Hangouts do pre-processing on media before you actually look at it, so that increases the vulnerability
    – David says Reinstate Monica
    Jul 28, 2015 at 17:40
  • Here is some information updated 3 days ago -- github.com/fuzzing/MFFA
    – atdre
    Jul 29, 2015 at 15:41
  • How the bug being attach in the mp4 file and how do the attacker determine the return address on incoming connection??? Please answer .
    – user107062
    Apr 10, 2016 at 7:00

2 Answers 2

Reset to default
47

The details will be released on the 5th of august. However, on the Cyanogenmod github repository there are several interesting details that appear to be related: it appears that certain fields in 3GPP video metadata are vulnerable to buffer overflow attacks. In short, a 3GPP video can be given a string of metadata that, at first, exceeds a certain length, and in the end includes machine code that lands in memory that is off-limits to the application.

Update: Cyanogenmod has released a patch for this vulnerability.

Improve this answer
8
  • 3
    Also, maybe this and this changes could be relevant.
    – Tomer
    Jul 28, 2015 at 14:13
  • 9
    It's especially worth noting that the person committing those changes is the person who disclosed the vulns, so it's a fair bet this is it...
    – Rory McCune
    Jul 28, 2015 at 14:23
  • 2
    Just curious, isn't fuzz testing performed on Android? If so, how do things like this not get caught?
    – dramzy
    Jul 28, 2015 at 17:27
  • 9
    @RespectMyAuthoritah Good question. From my experience in systems software QA, though, if you asked it of 100 software testers, one of them would say "Of course not! Are you nuts?" and the other 99 would say "What's fuzz testing?"
    – dodgethesteamroller
    Jul 28, 2015 at 22:18
  • 2
    Now that the 5th of August has been and gone, is there any further information?
    – James_pic
    Aug 24, 2015 at 13:47
8

In addition to the commits shown on github, Trend Labs have also posted a more detailed explanation of the integer overflow vulnerability (CVE-2015-3824) on their security blog. They demonstrate how it can be exploited from within an app, from a URL, and using MMS messages.

Update: As of 2016, there are now very detailed explanations and exploitations of this vulnerability. Look at the great Metaphor exploit paper for example.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .