Stagefright 2.0 Exploit Hits Android with Audio and Video Files

The Android exploit called Stagefright has a companion. Stagefright, a vulnerability in the Android operation systems from version 5.0 and newer allowed an attacker to send text messages to a device that would give the attacker remote access, was quickly disclosed and patched by Google. It has now been reported that a sister exploit can do the same by sending an audio or video file.

It is important to note that a particular set of circumstances has to be true for this exploit to work. However, one never knows when those will come together. Therefore, as soon as patches are released for any and all critical and security issues, they need to be applied right away.

As with the elder Stagefright and another recent Android vulnerability, Certific-gate, it’s up to the mobile service providers to release the patches to their customers. Often, this takes a while. So it is even more important to apply them immediately. Google did patch Stagefright 1.0 shortly after it was released to the public. It now says Stagefright 2.0, as it is being called by the researchers who originally discovered it, will be fixed in a release expected out the week of October 5.

Stagefright 2.0 actually involves two bugs and can be exploited on even the newer devices that have additional security controls. When the two are combined the audio or video files release malicious code onto the device, possibly even before the user knows what is happening. This is because the OS allows a “preview” of those files and that is all the exploit needs.

Google is taking these security issues seriously. If you don’t see an update ready for your Android device shortly after Google releases this patch, contact your service provider and ask them to take it seriously too and release the updates.