(2 ratings)
|
The security researchers from Israel have successfully detected and exploited an Android-based Stagefright bug and remotely hacked a phone, which may leave millions of Android devices vulnerable to attack. This comes within a year after the first Stagefright bug was discovered by cybersecurity firm Zimperium Mobile Security in July 2015 that highlighted that the Android smartphones could be hacked remotely by specially crafted media file delivered via MMS.
It's noteworthy that the Stagefright is an Android operating system multimedia library based on C++ language. The victims can be lured to websites with a malicious video file that are capable of crashing it. Google had released a patch for the earlier vulnerabilities but it is yet to acknowledge this newly found 'Metaphor exploit'.
The NorthBit research paper depicts a way to bypass Address Space Layout Randomisation (ASLR). The researchers have claimed to create a 'working exploit' while bypassing ASLR on versions 5.0 - 5.1, which affects Android versions 2.2 - 4.0 as well. The report noted that Android versions 2.2 - 4.0 do not come with the ASLR memory protection process.
"Breaking ASLR requires some information about the device, as different devices use slightly different configurations - which may change some offsets or predictable addresses locations," the paper said. Explaining the payload, the paper said, "It is possible to gain arbitrary pointer read to leak back to the web browser and gather information in order to break the ASLR".
At present there is around 235 million Android smartphone that operates on Android 5.0- 5.1 while another 40 million smartphones still run Android 2.x without ASLR, which is being said as the most vulnerable for these Stagefright bugs.
Must Visit Our Google+ Community Page For Latest And Updated Technology Happenings Around The Globe.
 |
 |
 |
 |
