Skip to main content
  1. Home
  2. Mobile
  3. News

Everything you need to know about Stagefright 2.0, Android’s newest security threat

By

outlook evernote facebook wunderlist looking at phone shutterstock 281039135
Shutterstock / Ser Borakovskyy
The scare that the original Stagefright hack caused is back in a reboot called Stagefright 2.0. This new strain was discovered by Zimperium zLabs, the same folks who found the original vulnerability.

Unfortunately, the really bad news is that Stagefright 2.0 affects almost every Android device ever released. According to Google’s latest stats, that’s about 1.4 billion devices worldwide. Even worse, it doesn’t matter if your device received a patch for the original Stagefright hack because this is a completely new vulnerability.

Recommended Videos

What is Stagefright 2.0?

Stagefright 2.0 is actually very similar to the original in that it deals with a media file containing malicious code that once executed, will give a hacker control of your device. In the case of Stagefright 1.0, it dealt with MP4 video files, but Stagefright 2.0 code can be executed from both MP4 video and MP3 audio files.

Just like the original, hackers would have access to all your data, and even be able to access the microphone and camera once the malicious code is executed.

The name Stagefright comes from the media playback engine in Android that has the same name. This playback engine is where the vulnerability resides, which Stagefright 2.0 can take full advantage of.

There are two vulnerabilities of Stagefright 2.0. The first one resides in libutils and affects almost every Android device since 2008. The second one resides in libstagefright and can be used on devices running Android 5.0 and higher.

How it works

The hacker would need to get an MP3 audio or MP4 video containing the malicious code on your device. The process of merely previewing the song or video would set the malicious code in motion.

The original Stagefright hack involved sending an MMS message of the malicious video file that Google Hangouts or other third-party Messenger apps would receive and automatically download. Patches have been issued for a number of devices, but users who don’t have a patched phone also have the ability to defend themselves by setting their apps to not download such media files automatically.

Since hackers can no longer use Google Hangouts or other Messenger apps, they have to use other methods to get a media file with Stagefright 2.0 code on your device. This can be done via a Web browser in that the victim is duped to visit a URL that is controlled by the attacker. An attacker could also use third party apps that would automatically install and possibly play a malicious media file. Finally, an attacker could manipulate your device by using common traffic interception techniques (MITM) if they are on the same network. This one is the least likely.

What is Google and other manufacturers doing?

Zimperium notified the Android Security team on August 15, and Google will issue a fix for the first vulnerability (libutils) next week. This will be pushed to Nexus devices, and is likely going to be included in the Android 6.0 Marshmallow update. Google has assigned CVE-2015-6602 to this vulnerability.

Google has yet to assign a Common Vulnerabilities and Exposures (CVE) number to the second vulnerability (libstagefright), so it’s not clear when a patch will be issued.

Zimperium also sent an update to the company’s Zimperium Headset Alliance (ZHA), which includes most major Android manufacturers. This information can be used by manufacturers to patch existing and upcoming devices.

Unfortunately, it’s unlikely that older devices, especially two years an older, will ever get the update. Manufacturers notoriously abandon older devices. While newer devices will likely receive the update, they will most likely get delayed due to carrier testing.

How can you defend yourself?

Unfortunately there isn’t much you can do at the moment, but we recommend the following:

  • Always download apps from Google Play or the Amazon App Store. Avoid other app stores, and do not sideload apps from untrusted sources.
  • Pay attention to the websites you’re visiting and don’t click on links in emails and text messages from people you’re not familiar with.
  • Download the Stagefright Detector app to find out if you’re device is affected. As of the time of this post, the app cannot detect Stagefright 2.0, but Zimperium will be updating it once Google issues its patch.

We will continue to update this post when Google and other manufacturers issue patches or if any new methods of defending yourself are discovered.

Editors' Recommendations

Topics
Robert Nazarian
Robert Nazarian
Former Digital Trends Contributor
Robert Nazarian became a technology enthusiast when his parents bought him a Radio Shack TRS-80 Color. Now his biggest…
Destiny 2 Trials of Osiris: Everything you need to know
Trials of Osiris Destiny 2

It’s been a long wait for competitive Destiny 2 players, but Trials of Osiris is finally back. The mode returns from a long hiatus thanks to the Empyrean Foundation community project, which was completed in the game’s last season. Trials of Osiris should be familiar to long-time players, but there are a few notable tweaks this time around. Here’s everything you need to know so you can begin your journey to the Lighthouse.
How does it work?
Trials of Osiris is a high-level player-versus-player (PVP) mode where two teams of three compete. In previous iterations, the playlist would cycle between two different objectives, but this time it’s only elimination. The mode is only available to play on weekends and can be accessed from the Crucible node on the director. There is no matchmaking in this mode, so you’ll need to go in with a full fireteam to compete.

The objective is simple: Kill everyone on the other team to win. There are no respawn timers here, but teammates are able to revive one another if they die. Each game lasts up to nine rounds, so the first team to survive five rounds wins the whole thing. Each round is two minutes long.

Read more
Samsung One UI 2.0 brings easier one-handed use and nonintrusive notifications
samsung one ui 2 0 announcement

At the Samsung Developer Conference, Samsung announced a new version of its Android skin, One UI. The new One UI 2.0 has been available as a beta to a few phones over the past few weeks, and offers a number of small tweaks to the One UI interface that helps make it a little more streamlined and easy to use.

One UI 2 was developed based on three principles: Making it simpler, more natural, and more comfortable. That said, while Samsung was quick to hype up the new Android skin, the changes are all relatively minor. Perhaps the biggest change to One UI is that it's based on Android 10 -- so you'll get access to many of the new Android 10 features straight from One UI 2.0.

Read more
OnePlus TV: Everything you need to know about the brand new 4K TV
oneplus tv sizes release date specs one plus launch

With a 55-inch QLED screen and a Pro model that features a motorized soundbar that drops down from the bottom of the 4K TV when it's fired up, the OnePlus TV is an interesting proposition from smartphone maker OnePlus — as it looks to disrupt the television market, taking on the likes of LG and Samsung.

Announced in India on September 26, the OnePlus TV isn't void of features. There's Dolby Atmos, which is seen to be the gold standard of at-home surround sound, Dolby Vision HDR for extracting additional detail from scenes, and a 4K Upscale Engine for rendering HD content in 4K Ultra HD.

Read more