Stagefright (bug)

From HandWiki
Short description: Software bug in Android
Stagefright
Stagefright bug logo.png
Logo of the Stagefright library bug
CVE identifier(s)CVE-2015-1538, CVE-2015-1539, CVE-2015-3824, CVE-2015-3826, CVE-2015-3827, CVE-2015-3828, CVE-2015-3829, CVE-2015-3864 (Stagefright 1.0),
CVE-2015-6602 (Stagefright 2.0)
Date discovered27 July 2015; 8 years ago (2015-07-27)
Date patched3 August 2015; 8 years ago (2015-08-03)
DiscovererJoshua Drake (Zimperium)
Affected softwareAndroid 2.2 "Froyo" and later (Stagefright 1.0),
Android 1.5 "Cupcake" to Android 5.1 "Lollipop" (Stagefright 2.0)

Stagefright is the name given to a group of software bugs that affect versions from 2.2 "Froyo" up until 5.1.1 "Lollipop"[1] of the Android operating system exposing an estimated 950 million devices (95% of all Android devices) at the time.[1] The name is taken from the affected library, which among other things, is used to unpack MMS messages.[2] Exploitation of the bug allows an attacker to perform arbitrary operations on the victim's device through remote code execution and privilege escalation.[3] Security researchers demonstrate the bugs with a proof of concept that sends specially crafted MMS messages to the victim device and in most cases requires no end-user actions upon message reception to succeed—the user doesn't have to do anything to 'accept' exploits using the bug; it happens in the background. A phone number is the only information needed to carry out the attack.[4][5][6][1]

The underlying attack vector exploits certain integer overflow vulnerabilities in the Android core component called libstagefright,[7][8][9] which is a complex software library implemented primarily in C++ as part of the Android Open Source Project (AOSP) and used as a backend engine for playing various multimedia formats such as MP4 files.[1][10]

The discovered bugs have been provided with multiple Common Vulnerabilities and Exposures (CVE) identifiers, CVE-2015-1538, CVE-2015-1539, CVE-2015-3824, CVE-2015-3826, CVE-2015-3827, CVE-2015-3828, CVE-2015-3829 and CVE-2015-3864 (the latter one has been assigned separately from the others), which are collectively referred to as the Stagefright bug.[11][12][13]

In order to exploit the vulnerability one doesn't specifically need an MMS message[14] (which was just an example of using the vulnr for RCE), but any other processing of the specifically crafted media by the vulnerable component is enough, that can be done via the most of applications having to deal with media files but not using own-bundled (which increases size of an app and imposes additional unjustified costs on its developer) pure software (which is slow and not energy efficient) media codecs for that, such as media players/galleries, web browsers (can cause drive-by compromise) and file managers showing thumbnails (can be used for achieving persistence).

History

The Stagefright bug was discovered by Joshua Drake from the Zimperium security firm, and was publicly announced for the first time on July 27, 2015. Prior to the announcement, Drake reported the bug to Google in April 2015, which incorporated a related bugfix into its internal source code repositories two days after the report.[4][5][6][1] In July 2015, Evgeny Legerov, a Moscow-based security researcher, announced that he had found at least two similar heap overflow zero-day vulnerabilities in the Stagefright library, claiming at the same time that the library has been already exploited for a while. Legerov also confirmed that the vulnerabilities he discovered become unexploitable by applying the patches Drake submitted to Google.[3][15]

The public full disclosure of the Stagefright bug, presented by Drake, took place on August 5, 2015 at the Black Hat USA[16] computer security conference, and on August 7, 2015 at the DEF CON 23[17] hacker convention.[1] Following the disclosure, on August 5, 2015, Zimperium publicly released the source code of a proof-of-concept exploit, actual patches for the Stagefright library (although the patches were already publicly available since early May 2015 in the AOSP and other open-source repositories[18][19]), and an Android application called "Stagefright detector" that tests whether an Android device is vulnerable to the Stagefright bug.[12][20]

On August 13, 2015, another Stagefright vulnerability, CVE-2015-3864, was published by Exodus Intelligence.[13] This vulnerability was not mitigated by existing fixes of already known vulnerabilities. CyanogenMod team published a notice that patches for CVE-2015-3864 have been incorporated in CyanogenMod 12.1 source on August 13, 2015.[21]

On October 1, 2015, Zimperium released details of further vulnerabilities, also known as Stagefright 2.0. This vulnerability affects specially crafted MP3 and MP4 files that execute their payload when played using the Android Media server. The vulnerability has been assigned identifier CVE-2015-6602 and was found in a core Android library called libutils; a component of Android that has existed since Android was first released. Android 1.5 through 5.1 are vulnerable to this new attack and it is estimated that one billion devices are affected.[22]

Implications

While Google maintains the Android's primary codebase and firmware, updates for various Android devices are the responsibility of wireless carriers and original equipment manufacturers (OEMs). As a result, propagating patches to the actual devices often introduces long delays due to a large fragmentation between the manufacturers, device variants, Android versions, and various Android customizations performed by the manufacturers;[23][24] furthermore, many older or lower cost devices may never receive patched firmware at all.[25] Many of the unmaintained devices would need to be rooted, which violates the terms of many wireless contracts. Therefore, the nature of Stagefright bug highlights the technical and organizational difficulties associated with the propagation of Android patches.[5][26]

As an attempt to address the delays and issues associated with the propagation of Android patches, on August 1, 2015 Zimperium formed the Zimperium Handset Alliance (ZHA) as an association of different parties interested in exchanging information and receiving timely updates on Android's security-related issues. Members of the ZHA also received source code of the Zimperium's proof-of-concept Stagefright exploit before it was publicly released. (As of August 2015), 25 of the largest Android device OEMs and wireless carriers have joined the ZHA.[12][18][27]

Mitigation

Certain mitigations of the Stagefright bug exist for devices that run unpatched versions of Android, including disabling the automatic retrieval of MMS messages and blocking the reception of text messages from unknown senders. However, these two mitigations are not supported in all MMS applications (the Google Hangouts app, for example, only supports the former),[3][5] and they do not cover all feasible attack vectors that make exploitation of the Stagefright bug possible by other means, such as by opening or downloading a malicious multimedia file using the device's web browser.[7][28]

At first it was thought that further mitigation could come from the address space layout randomization (ASLR) feature that was introduced in Android 4.0 "Ice Cream Sandwich", fully enabled in Android 4.1 "Jelly Bean";[7][29] The version of Android 5.1 "Lollipop" includes patches against the Stagefright bug.[11][30] Unfortunately, later results and exploits like Metaphor that bypass ASLR were discovered in 2016.

As of Android 10, software codecs were moved to a sandbox which effectively mitigates this threat for devices capable of running this version of the OS.[7][31]

See also

References

  1. ↑ 1.0 1.1 1.2 1.3 1.4 1.5 "Experts Found a Unicorn in the Heart of Android". July 27, 2015. http://blog.zimperium.com/experts-found-a-unicorn-in-the-heart-of-android/. 
  2. ↑ "Stagefright: Everything you need to know about Google's Android megabug". http://fortune.com/2015/07/28/stagefright-google-android-security/. 
  3. ↑ 3.0 3.1 3.2 "How to Protect from StageFright Vulnerability". July 30, 2015. http://blog.zimperium.com/how-to-protect-from-stagefright-vulnerability/. 
  4. ↑ 4.0 4.1 Rundle, Michael (July 27, 2015). "'Stagefright' Android bug is the 'worst ever discovered'". Wired. https://www.wired.co.uk/news/archive/2015-07/27/stagefight-android-bug. Retrieved July 28, 2015. 
  5. ↑ 5.0 5.1 5.2 5.3 Vaughan-Nichols, Steven J. (July 27, 2015). "Stagefright: Just how scary is it for Android users?". ZDNet. http://www.zdnet.com/article/stagefright-just-how-scary-is-it-for-android-users/. 
  6. ↑ 6.0 6.1 Hern, Alex (July 28, 2015). "Stagefright: new Android vulnerability dubbed 'heartbleed for mobile'". The Guardian. https://www.theguardian.com/technology/2015/jul/28/stagefright-android-vulnerability-heartbleed-mobile. 
  7. ↑ 7.0 7.1 7.2 7.3 Wassermann, Garret (July 29, 2015). "Vulnerability Note VU#924951 – Android Stagefright contains multiple vulnerabilities". CERT. https://www.kb.cert.org/vuls/id/924951. 
  8. ↑ "Android Interfaces: Media". May 8, 2015. http://source.android.com/devices/media.html. 
  9. ↑ "platform/frameworks/av: media/libstagefright". July 28, 2015. https://android.googlesource.com/platform/frameworks/av/+/master/media/libstagefright. 
  10. ↑ Kumar, Mohit (July 27, 2015). "Simple Text Message to Hack Any Android Phone Remotely". http://thehackernews.com/2015/07/android-phone-hacking.html. 
  11. ↑ 11.0 11.1 Hackett, Robert (July 28, 2015). "Stagefright: Everything you need to know about Google's Android megabug". Fortune. http://fortune.com/2015/07/28/stagefright-google-android-security/. Retrieved July 29, 2015. 
  12. ↑ 12.0 12.1 12.2 "Stagefright: Vulnerability Details, Stagefright Detector tool released". August 5, 2015. https://blog.zimperium.com/stagefright-vulnerability-details-stagefright-detector-tool-released/. 
  13. ↑ 13.0 13.1 Gruskovnjak, Jordan; Portnoy, Aaron (August 13, 2015). "Stagefright: Mission Accomplished?". https://blog.exodusintel.com/2015/08/13/stagefright-mission-accomplished/. 
  14. ↑ https://play.google.com/store/apps/details?id=com.zimperium.stagefrightdetector
  15. ↑ Thomas Fox-Brewster (July 30, 2015). "Russian 'Zero Day' Hunter Has Android Stagefright Bugs Primed For One-Text Hacks". Forbes. https://www.forbes.com/sites/thomasbrewster/2015/07/30/stagefright-vulnerabilties-ready-for-testing/. Retrieved July 31, 2015. 
  16. ↑ "Stagefright: Scary Code in the Heart of Android". August 21, 2015. https://www.blackhat.com/us-15/briefings.html#stagefright-scary-code-in-the-heart-of-android. 
  17. ↑ "Stagefright: Scary Code in the Heart of Android". 7 August 2015. https://www.defcon.org/html/defcon-23/dc-23-speakers.html#Drake. 
  18. ↑ 18.0 18.1 "ZHA – Accelerating Roll-out of Security Patches". August 1, 2015. https://blog.zimperium.com/zha-zimperiums-initiative-to-fill-the-gaps-in-android-security/. 
  19. ↑ Joshua J. Drake (May 5, 2015). "Change Ie93b3038: Prevent reading past the end of the buffer in 3GPP". https://android-review.googlesource.com/#/c/162630/. 
  20. ↑ Eric Ravenscraft (August 7, 2015). "Stagefright Detector Detects if Your Phone Is Vulnerable to Stagefright". http://lifehacker.com/stagefright-detector-detects-if-your-phone-is-vulnerabl-1722662061. 
  21. ↑ "More Stagefright". August 13, 2015. http://www.cyanogenmod.org/blog/more-stagefright. 
  22. ↑ "Stagefright 2.0 Vulnerabilities Affect 1 Billion Android Devices". October 1, 2015. https://threatpost.com/stagefright-2-0-vulnerabilities-affect-1-billion-android-devices/114863/. 
  23. ↑ Jamie Lendino (July 27, 2015). "950M phones at risk for 'Stagefright' text exploit thanks to Android fragmentation". http://www.extremetech.com/mobile/210906-950m-phones-at-risk-for-stagefright-text-hack-thanks-to-android-fragmentation. 
  24. ↑ Jordan Minor (July 30, 2015). "There's (Almost) Nothing You Can Do About Stagefright". PC Magazine. https://www.pcmag.com/article2/0,2817,2488772,00.asp. Retrieved July 31, 2015. 
  25. ↑ Cooper Quintin (July 31, 2015). "StageFright: Android's Heart of Darkness". Electronic Frontier Foundation. https://www.eff.org/deeplinks/2015/07/horror-horror-stagefright-androids-heart-darkness. 
  26. ↑ Phil Nickinson (July 27, 2015). "The 'Stagefright' exploit: What you need to know". Android Central. http://www.androidcentral.com/stagefright-exploit-what-you-need-know. 
  27. ↑ Lucian Armasu (August 6, 2015). "Zimperium Releases Stagefright Vulnerability Detector". Tom's Hardware. http://www.tomshardware.com/news/zimperium-stagefright-vulnerability-detector-app,29770.html. 
  28. ↑ Joshua Drake (August 5, 2015). "Stagefright: Scary Code in the Heart of Android – Researching Android Multimedia Framework Security". pp. 31–39. https://www.blackhat.com/docs/us-15/materials/us-15-Drake-Stagefright-Scary-Code-In-The-Heart-Of-Android.pdf. 
  29. ↑ Jon Oberheide (July 16, 2012). "Exploit Mitigations in Android Jelly Bean 4.1". https://www.duosecurity.com/blog/exploit-mitigations-in-android-jelly-bean-4-1. 
  30. ↑ Michael Crider (July 28, 2015). "Google Promises a Stagefright Security Update For Nexus Devices Starting Next Week". http://www.androidpolice.com/2015/07/28/google-representative-promises-a-stagefright-security-update-for-nexus-devices-starting-next-week/. 
  31. ↑ Jeff Vander Stoep, Android Security & Privacy Team and Chong Zhang, Android Media Team (May 9, 2019). "Queue Hardening Enhancements". https://android-developers.googleblog.com/2019/05/queue-hardening-enhancements.html. 

External links



Retrieved from "https://handwiki.org/wiki/index.php?title=Stagefright_(bug)&oldid=3374782"