5

I saw a question about Android's "Stagefright" vulnerability, and I got to thinking: other OS'es pre-process MMS messages to make it easier to view. iOS does it and shows a preview. Even BREW OS (the OS that comes with a basic flip/slider phone) has an option to auto-download an MMS.

If the vulnerability operates by exploiting a flaw in a 3GPP video's metadata, then wouldn't iOS and many other mobile OS's be susceptible to this vulnerability? Or is it just Android's "Hangouts" app?

7

The bug isn't with the file format, it's with the software of Hangouts the Android software library. iOS, Android, and Windows phones run system software from three different groups of developers. As such, this vulnerability probably doesn't exist on other platforms. Even if it did, one payload couldn't affect all three systems, because their software isn't binary compatible at the ABI (application binary interface) level of the OS. A valid exploit in system code on one system that caused, say, a rootkit install would likely only cause the other systems to crash, which would still be bad, but the systems could probably recover without too much trouble.

|improve this answer|||||
  • 1
    I see. Code does different things on different OSes. One binary might not work with iOS, but it'll work with Android. Thank you for the detailed answer! – DDPWNAGE Jul 29 '15 at 3:13
  • 3
    The bug isn't with hangouts, the problem is the software which decodes media. Hangouts is just a vector for getting those decoders to decode things – Squidly Jul 29 '15 at 10:19
  • If it only were a bug in Hangouts this wouldn't be such a problem because it would be easy to push an update through Play Store. This bug really shows the security value of using CM compared to stock Android. – efr4k Jul 29 '15 at 11:49
  • @MrBones Fair enough. The main point of the answer was simply to state that a vulnerability, especially one that targets system software on a certain operating system, can't propagate to other systems, like Windows Phone, iOS, Windows Desktop, or Mac OSX, unless they shared the same code. – phyrfox Jul 29 '15 at 13:34
  • @DDPWNAGE "One binary might not work with iOS, but it'll work with Android." is not the right way to think about this particular bug; that's like asking if my Mazda is affected by a defect in Chrysler's manufacturing. StageFright is an issue with how Android implemented the 3GPP decoder, which is buried deep in the compiled OS code. Each OS will have its own implementation of this library. – Mike Ounsworth Jul 29 '15 at 13:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.