Android libstagefright still exploitable
blog.exodusintel.com
Android libstagefright still exploitable
1–10 of 150 posts
Re: Android libstagefright still exploitable
#2Did I read that right? They reported the bug to Google on August 7th and disclosed it publicly on August 13th?
Is this still responsible disclosure if they give Google basically 6 days to respond and use the original notification date as justification? I'm not learned enough in the practice of responsible disclosure to know if this is common, but I've not seen that before.
Re: Android libstagefright still exploitable
#3Even if Google patches this, there's an incredible delay in getting the patch to users. Android in fundamentally flawed in this respect.
http://www.extremetech.com/mobile/197346-google-throws-nearl...
Re: Android libstagefright still exploitable
#4>Deadline exceeded – automatically derestricting
>The flaw was initially reported over 120 days ago to Google, which exceeds even their own 90-day disclosure deadline.
It always seemed likely that Google's hubris[1] would come back to haunt them. I guess this is that day.
It would be funny if it wasn't remote code execution affecting 950 million phones, with no official patch in sight.
Re: Android libstagefright still exploitable
#5Did I read that right? They reported the bug to Google on August 7th and disclosed it publicly on August 13th? Is this still responsible disclosure if they give Google basically 6 days to respond and use the original notification date as justification? I'm not learned enough in the practice of responsible disclosure to know if this is common, but I've not seen that before.
[deleted]
Re: Android libstagefright still exploitable
#6>Deadline exceeded – automatically derestricting >The flaw was initially reported over 120 days ago to Google, which exceeds even their own 90-day disclosure deadline. It always seemed likely that Google's hubris[1] would come back to haunt them. I guess this is that day. It would be funny if it wasn't remote code execution affecting 950 million phones, with no official patch in sight. [1] https://news.ycombinator.co…
[deleted]
Re: Android libstagefright still exploitable
#7Summary: A little over two weeks ago, it was publicly disclosed that MMS messages can cause Android phones to decode video with libstagefright, which is a C++ library with vulnerabilities and insufficient sandboxing, leading to remote code execution without user interaction. Today, Exodus Intelligence is reporting that the patch to fix one of these vulnerabilities does not, in fact, fix it. Thus, all Android phones are still vulnerable.
You can partially mitigate the risk by disabling auto-downloading of MMS messages in whichever app you have set to handle text messages, such as Messaging or Hangouts. If you have not done so already, this is urgent. Furthermore, you should assume that auto-downloading of MMS messages will not ever be safe, no matter how many individual security fixes are applied, until this component of Android is significantly re-architected.
Re: Android libstagefright still exploitable
#8>Deadline exceeded – automatically derestricting >The flaw was initially reported over 120 days ago to Google, which exceeds even their own 90-day disclosure deadline. It always seemed likely that Google's hubris[1] would come back to haunt them. I guess this is that day. It would be funny if it wasn't remote code execution affecting 950 million phones, with no official patch in sight. [1] https://news.ycombinator.co…
They have become a bit more flexible[0] after the Windows issue. They are still living by the 90 day policy, but baked in some flexibility if the vendor is communicating with them.
[0] http://googleprojectzero.blogspot.com/2015/02/feedback-and-d...
Re: Android libstagefright still exploitable
#9Is this timeline correct?
April 2015 - Original stagefright exposed
July 31st - Author noticed patch was not sufficient but could not test (did not notify google)
August 6th - Patch released
August 7th - Author notified google that patch was not adequate
August 13th - Author went public?!?!
They are counting the original date of exploitation as the start date for notification. I would think a more responsible and friendly date would be August 7th. Just me.
Re: Android libstagefright still exploitable
#10Did I read that right? They reported the bug to Google on August 7th and disclosed it publicly on August 13th? Is this still responsible disclosure if they give Google basically 6 days to respond and use the original notification date as justification? I'm not learned enough in the practice of responsible disclosure to know if this is common, but I've not seen that before.
It isn't a new bug; what they're reporting is that the patch which was supposed to fix an already-publicly-disclosed bug doesn't fully fix it.