Stagefright 2.0 discovered: ALL Android phones can be INFECTED via web pages and media files

Vaughn Highfield October 5, 2015

Stagefright, a security loophole found to affect 95% of Android smartphones, was supposed to have been quashed by updates from the likes of Samsung, HTC and Google. However, a bigger threat has been discovered and security experts have dubbed it Stagefright 2.0.

Stagefright 2.0 discovered: ALL Android phones can be INFECTED via web pages and media files

The same mobile security firm that uncovered Stagefright in April, Zimperium, has found another media-based vulnerability in Android. Known as Stagefright 2.0, this exploit manifests itself when processing specially crafted MP3 or MP4 files and is prevalent in every Android device since the first version.

The big difference between Stagefright 2.0 and the original vulnerability is the minimal amount of user information an attacker needs to gain access to your phone. While Stagefright required knowledge of your mobile number to launch an attack via MMS, this time you need only visit a website hosting an infected video or audio file. The moment you start the video or audio, an attacker can gain access to everything inside your phone.

Google originally fixed the Stagefright issue with an update to its Hangouts application, and other phone manufacturers with Android reskins also issued fixes. This means that attacks through messaging will be extremely limited, but an attack through a web browser is far harder to prevent.

android_marshmallow_update_-_software_update

Zimperium says it alerted Google’s Android Security Team to the issue on 15 August. Since then, Google has been hard at work and the upcoming Nexus security update will fix the issue. Interestingly, Zimperium says there’s another vulnerability, of which Google is also aware, but it can’t disclose exactly what it is until a fix is on the way. While that’s a little unnerving, at least nobody can exploit it if they don’t know what it is.

While Google has committed to providing regular security updates to Android, and Android Marshmallow promises to offer even more security than before, it is alarming that huge holes are being uncovered in Google’s mobile OS.

If you’re worried about having Stagefright on your Android device and want to ensure you don’t get it, take a look at our guide on how to stop Stagefright on Android Lollipop.