Holes in audio and video handling systems could allow hackers to take over your device by just visiting a website, warn security experts

More than 1bn Android smartphones and devices are vulnerable to a new security vulnerability dubbed Stagefright 2.0, warn security experts.



The follow-up to the Stagefright bug, which allowed hackers to take over an Android smartphone by sending it an MMS message, Stagefright 2.0 is security vulnerability made of two holes in Android that can allow an attacker to take over a smartphone via an MP3 or MP4 video.

Mark James, security specialist at ESET said: “Visiting a website and previewing an infected song or video file could enable the attacker to gain access to your mobile device and run remote code, in theory allowing them full access to your device enabling them to do whatever they wish ... including installing other malware, or just harvesting your data for use in identity theft.”

The vulnerability affects even those smartphones that have had the original Stagefright bug patched, such as Google’s Nexus devices and Samsung’s Galaxy S6 series.

“The first vulnerability (in libutils) impacts almost every Android device since version 1.0 released in 2008. We found methods to trigger that vulnerability in devices running version 5.0 and up using the second vulnerability (in libstagefright),” said Zimperium, the company that first disclosed the original Stagefright bug.

The security holes lie within the media processing systems of Android, which can be broken, potentially allowing access to the the rest of the smartphone using specially crafted MP3 audio files or MP4 videos – both common formats for songs and videos.

“The first version of Stagefright required some information, namely your mobile number to be able to send the text message to your device,” says James. This new version does not even need to know any of your information to be successful. This, in theory, enables a much wider audience and indeed could enable access to over 1bn android devices.”

Rated as critical

Google was notified of the bugs on 15 August. The company acknowledged the security holes, saying “this issue is rated as a critical severity due to the possibility of remote code execution as the privileged mediaserver service. The mediaserver service has access to audio and video streams as well as access to privileges that third party apps cannot normally access.”

The bugs are due to be patched in Google’s monthly security update for October for its Nexus smartphones. Patches for other smartphones will be at the discretion of their manufacturers and the mobile phone providers. Google provided the fixes to manufacturers on 10 September.

Google, LG, Samsung and others have pledged to roll out monthly security updates for the smartphones in the wake of the original Stagefright bug.

Security company Symantec notes that there have been no reports of Stagefright 2.0 being exploited in the wild but that “until a patch is applied, proceed cautiously when using your mobile browser to preview unsolicited audio and video files”.

“You absolutely have to think before visiting websites, all too often people fail to understand their mobile devices are just as much at risk as their desktops,” said James.