Stagefright Bug - Android security is compromised??
Post by: bond
Stage fright - This bug allows an attacker to remotely execute code through a phony multimedia text message, in many cases without the user even seeing the message itself. Its been 10 days since Zimperium's Joshua Drake revealed this new Android vulnerability and Android is just starting to recover. Google took months to write a patch and already had one ready when the bug was announced, but as expected, getting the patch through manufacturers and carriers was complicated and difficult.
But then, something unexpected happened: the much-maligned Android update system started to work. Samsung, HTC, LG, Sony and Android One have already announced pending patches for the bug, along with a device-specific patch for the Alcatel Idol 3. In Samsung's case, the shift has kicked off an aggressive new security policy that will deploy patches month by month, an example that's expected to inspire other manufacturers to follow suit. Google has announced a similar program for its own Nexus phones. Stagefright seems to have scared manufacturers and carriers into action, and as it turns out, this fragmented ecosystem still has lots of ways to protect itself.
By the way, It's still early, and most devices won't receive the patch until later this month, but Android security head Adrian Ludwig is optimistic that most Android users will be protected by existing mitigation systems, and expects patches to be deployed before attackers can break through.
This bug really isn't as worrisome as people portrayed it. Security researchers (often working for companies selling security software) have cried wolf so many times I really don't take any of them seriously at this point, no matter which operating system's users they are trying to scare into buying their crap.
