View source for Stagefright (bug)

{{Short description|Software bug in Android}}
{{Infobox bug
| image = Stagefright bug logo.png
| caption = Logo of the Stagefright library bug
| CVE = {{CVE|2015-1538|2015-1539|2015-3824|2015-3826|2015-3827|2015-3828|2015-3829|2015-3864}} (Stagefright 1.0),<br/>
{{CVE|2015-6602|link=no}} (Stagefright 2.0)
| discovered = {{Start date and age|2015|7|27|df=yes}}
| patched = {{Start date and age|2015|8|3|df=yes}}
| discoverer = Joshua Drake ([[Company:Zimperium|Zimperium]])
| affected software = [[Software:Android Froyo|Android 2.2 "Froyo"]] and later (Stagefright 1.0),<br/>
[[Software:Android Cupcake|Android 1.5 "Cupcake"]] to [[Software:Android Lollipop|Android 5.1 "Lollipop"]] (Stagefright 2.0)
| website =
}}

'''Stagefright''' is the name given to a group of [[Software bug|software bug]]s that affect versions from [[Software:Android Froyo|2.2 "Froyo"]] up until [[Software:Android Lollipop|5.1.1 "Lollipop"]]<ref name="zimperium-unicorn" /> of the [[Software:Android (operating system)|Android]] [[Operating system|operating system]] exposing an estimated 950 million devices (95% of all Android devices) at the time.<ref name="zimperium-unicorn" /> The name is taken from the affected library, which among other things, is used to unpack [[Multimedia Messaging Service|MMS]] messages.<ref>{{cite web|url=http://fortune.com/2015/07/28/stagefright-google-android-security/|title=Stagefright: Everything you need to know about Google's Android megabug}}</ref> Exploitation of the bug allows an attacker to perform arbitrary operations on the victim's device through remote code execution and [[Privilege escalation|privilege escalation]].<ref name="zimperium-protection">{{cite web
 | url = http://blog.zimperium.com/how-to-protect-from-stagefright-vulnerability/
 | title = How to Protect from StageFright Vulnerability
 | date = July 30, 2015 | access-date = July 31, 2015
 | website = zimperium.com
}}</ref>  [[Computer security|Security]] researchers demonstrate the bugs with a [[Proof of concept|proof of concept]] that sends specially crafted MMS messages to the victim device and in most cases requires no end-user actions upon message reception to succeed—the user doesn't have to do anything to 'accept' exploits using the bug; it happens in the background. A phone number is the only information needed to carry out the attack.<ref name="wired">{{cite magazine
 | url = https://www.wired.co.uk/news/archive/2015-07/27/stagefight-android-bug
 | title = 'Stagefright' Android bug is the 'worst ever discovered'
 | date = July 27, 2015 | access-date = July 28, 2015
 | first = Michael | last = Rundle | magazine = Wired
}}</ref><ref name="zdnet">{{cite news
 | url = http://www.zdnet.com/article/stagefright-just-how-scary-is-it-for-android-users/
 | title = Stagefright: Just how scary is it for Android users?
 | date = July 27, 2015 | access-date = July 28, 2015
 | first = Steven J. | last = Vaughan-Nichols | work = [[ZDNet]]
}}</ref><ref name="theguardian">{{cite news
 | url = https://www.theguardian.com/technology/2015/jul/28/stagefright-android-vulnerability-heartbleed-mobile
 | title = Stagefright: new Android vulnerability dubbed 'heartbleed for mobile'
 | date = July 28, 2015 | access-date = July 29, 2015
 | first = Alex | last = Hern | newspaper = {{wipe|The Guardian}}
}}</ref><ref name="zimperium-unicorn">{{cite web
 | url = http://blog.zimperium.com/experts-found-a-unicorn-in-the-heart-of-android/
 | title = Experts Found a Unicorn in the Heart of Android
 | date = July 27, 2015 | access-date = July 28, 2015
 | website = zimperium.com
}}</ref>

The underlying [[Attack vector|attack vector]] exploits certain [[Integer overflow|integer overflow]] [[Vulnerability (computing)|vulnerabilities]] in the Android core component called {{Mono|libstagefright}},<ref name="cert">{{cite web
 | url = https://www.kb.cert.org/vuls/id/924951
 | title = Vulnerability Note VU#924951 – Android Stagefright contains multiple vulnerabilities
 | date = July 29, 2015 | access-date = July 31, 2015
 | first = Garret | last = Wassermann | publisher = CERT
}}</ref><ref>{{cite web
 | url = http://source.android.com/devices/media.html
 | title = Android Interfaces: Media
 | date = May 8, 2015 | access-date = July 28, 2015
 | website = source.android.com
}}</ref><ref>{{cite web
 | url = https://android.googlesource.com/platform/frameworks/av/+/master/media/libstagefright
 | title = platform/frameworks/av: media/libstagefright
 | date = July 28, 2015 | access-date = July 31, 2015
 | website = android.googlesource.com
}}</ref> which is a complex software library implemented primarily in [[C++]] as part of the Android Open Source Project (AOSP) and used as a backend engine for playing various multimedia formats such as [[MP4]] files.<ref name="zimperium-unicorn" /><ref>{{cite web
 | url = http://thehackernews.com/2015/07/android-phone-hacking.html
 | title = Simple Text Message to Hack Any Android Phone Remotely
 | date = July 27, 2015 | access-date = July 28, 2015
 | first = Mohit | last = Kumar | website = thehackernews.com
}}</ref>

The discovered bugs have been provided with multiple Common Vulnerabilities and Exposures (CVE) identifiers, {{CVE|2015-1538|2015-1539|2015-3824|2015-3826|2015-3827|2015-3828|2015-3829|2015-3864|leadout=and}} (the latter one has been assigned separately from the others), which are collectively referred to as the Stagefright bug.<ref name="fortune">{{cite magazine
 | url = http://fortune.com/2015/07/28/stagefright-google-android-security/
 | title = Stagefright: Everything you need to know about Google's Android megabug
 | date = July 28, 2015 | access-date = July 29, 2015
 | first = Robert | last = Hackett | magazine = Fortune
}}</ref><ref name="zimperium-detector">{{cite web
 | url = https://blog.zimperium.com/stagefright-vulnerability-details-stagefright-detector-tool-released/
 | title = Stagefright: Vulnerability Details, Stagefright Detector tool released
 | date = August 5, 2015 | access-date = August 25, 2015
 | website = zimperium.com
}}</ref><ref name="exodusintel">{{cite web
 | url = https://blog.exodusintel.com/2015/08/13/stagefright-mission-accomplished/
 | title = Stagefright: Mission Accomplished?
 | date = August 13, 2015 | access-date = October 8, 2015
 | first1 = Jordan | last1 = Gruskovnjak
 | first2 = Aaron | last2 = Portnoy
 | website = exodusintel.com
}}</ref>

In order to exploit the vulnerability one doesn't specifically need an MMS message<ref>https://play.google.com/store/apps/details?id=com.zimperium.stagefrightdetector</ref> (which was just an example of using the vulnr for RCE), but any other processing of the specifically crafted media by the vulnerable component is enough, that can be done via the most of applications having to deal with media files but not using own-bundled (which increases size of an app and imposes additional unjustified costs on its developer) pure software (which is slow and not energy efficient) media codecs for that, such as media players/galleries, web browsers (can cause [[Drive-by download|drive-by]] compromise) and file managers showing thumbnails (can be used for achieving persistence).

== History ==
The Stagefright bug was discovered by Joshua Drake from the [[Company:Zimperium|Zimperium]] security firm, and was publicly announced for the first time on July 27, 2015.  Prior to the announcement, Drake reported the bug to [[Company:Google|Google]] in April 2015, which incorporated a related bugfix into its internal source code repositories two days after the report.<ref name="wired" /><ref name="zdnet" /><ref name="theguardian" /><ref name="zimperium-unicorn" />  In July 2015, Evgeny Legerov, a Moscow-based security researcher, announced that he had found at least two similar [[Heap overflow|heap overflow]] zero-day vulnerabilities in the Stagefright library, claiming at the same time that the library has been already exploited for a while.  Legerov also confirmed that the vulnerabilities he discovered become unexploitable by applying the [[Patch (computing)|patches]] Drake submitted to Google.<ref name="zimperium-protection" /><ref>{{cite magazine
 | url = https://www.forbes.com/sites/thomasbrewster/2015/07/30/stagefright-vulnerabilties-ready-for-testing/
 | title = Russian 'Zero Day' Hunter Has Android Stagefright Bugs Primed For One-Text Hacks
 | date = July 30, 2015 | access-date = July 31, 2015
 | author = Thomas Fox-Brewster | magazine = {{wipe|Forbes}}
}}</ref>

The public [[Full disclosure (computer security)|full disclosure]] of the Stagefright bug, presented by Drake, took place on August 5, 2015 at the Black Hat USA<ref>{{cite web
 | url = https://www.blackhat.com/us-15/briefings.html#stagefright-scary-code-in-the-heart-of-android
 | title = Stagefright: Scary Code in the Heart of Android
 | date = August 21, 2015 | access-date = August 25, 2015
 | website = blackhat.com
}}</ref> computer security conference, and on August 7, 2015 at the DEF&nbsp;CON&nbsp;23<ref>{{cite web
 | url = https://www.defcon.org/html/defcon-23/dc-23-speakers.html#Drake
 | title = Stagefright: Scary Code in the Heart of Android
 | date = 7 August 2015 | access-date = August 25, 2015
 | website = defcon.org
}}</ref> hacker convention.<ref name="zimperium-unicorn" />  Following the disclosure, on August 5, 2015, Zimperium publicly released the [[Source code|source code]] of a proof-of-concept exploit, actual patches for the Stagefright library (although the patches were already publicly available since early May 2015 in the AOSP and other open-source repositories<ref name="zimperium-zha">{{cite web
 | url = https://blog.zimperium.com/zha-zimperiums-initiative-to-fill-the-gaps-in-android-security/
 | title = ZHA – Accelerating Roll-out of Security Patches
 | date = August 1, 2015 | access-date = August 25, 2015
 | website = zimperium.com
}}</ref><ref>{{cite web
 | url = https://android-review.googlesource.com/#/c/162630/
 | title = Change Ie93b3038: Prevent reading past the end of the buffer in 3GPP
 | date = May 5, 2015 | access-date = August 25, 2015
 | author = Joshua J. Drake | website = android-review.googlesource.com
}}</ref>), and an Android application called "Stagefright detector" that tests whether an Android device is vulnerable to the Stagefright bug.<ref name="zimperium-detector" /><ref>{{cite web
 | url = http://lifehacker.com/stagefright-detector-detects-if-your-phone-is-vulnerabl-1722662061
 | title = Stagefright Detector Detects if Your Phone Is Vulnerable to Stagefright
 | date = August 7, 2015 | access-date = August 25, 2015
 | author = Eric Ravenscraft | website = lifehacker.com
}}</ref>

On August 13, 2015, another Stagefright vulnerability, {{CVE|2015-3864}}, was published by Exodus Intelligence.<ref name="exodusintel" /> This vulnerability was not mitigated by existing fixes of already known vulnerabilities. CyanogenMod team published a notice that patches for CVE-2015-3864 have been incorporated in CyanogenMod 12.1 source on August 13, 2015.<ref>{{cite web
 |url         = http://www.cyanogenmod.org/blog/more-stagefright
 |title       = More Stagefright
 |date        = August 13, 2015
 |access-date  = August 15, 2015
 |website     = www.cyanogenmod.org
 |archive-url  = https://web.archive.org/web/20150813225550/http://www.cyanogenmod.org/blog/more-stagefright
 |archive-date = August 13, 2015
}}</ref>

On October 1, 2015, Zimperium released details of further vulnerabilities, also known as Stagefright 2.0. This vulnerability affects specially crafted MP3 and MP4 files that execute their payload when played using the Android Media server.  The vulnerability has been assigned identifier {{CVE|2015-6602}} and was found in a core Android library called libutils; a component of Android that has existed since Android was first released. Android 1.5 through 5.1 are vulnerable to this new attack and it is estimated that one billion devices are affected.<ref>{{cite web
 | url = https://threatpost.com/stagefright-2-0-vulnerabilities-affect-1-billion-android-devices/114863/
 | title = Stagefright 2.0 Vulnerabilities Affect 1 Billion Android Devices
 | date = October 1, 2015 | access-date = October 1, 2015
 | website = threatpost.com
}}</ref>

== {{Anchor|ZHA}}Implications ==
While Google maintains the Android's primary [[Codebase|codebase]] and [[Firmware|firmware]], updates for various Android devices are the responsibility of wireless carriers and [[Finance:Original equipment manufacturer|original equipment manufacturer]]s (OEMs).  As a result, propagating patches to the actual devices often introduces long delays due to a large fragmentation between the manufacturers, device variants, Android versions, and various Android customizations performed by the manufacturers;<ref>{{cite web
 | url = http://www.extremetech.com/mobile/210906-950m-phones-at-risk-for-stagefright-text-hack-thanks-to-android-fragmentation
 | title = 950M phones at risk for 'Stagefright' text exploit thanks to Android fragmentation
 | date = July 27, 2015 | access-date = July 31, 2015
 | author = Jamie Lendino | website = extremetech.com
}}</ref><ref>{{cite magazine
 | url = https://www.pcmag.com/article2/0,2817,2488772,00.asp
 | title = There's (Almost) Nothing You Can Do About Stagefright
 | date = July 30, 2015 | access-date = July 31, 2015
 | author = Jordan Minor | magazine = PC Magazine
}}</ref> furthermore, many older or lower cost devices may never receive patched firmware at all.<ref>{{cite web
 | url = https://www.eff.org/deeplinks/2015/07/horror-horror-stagefright-androids-heart-darkness
 | title = StageFright: Android's Heart of Darkness
 | date = July 31, 2015 | access-date = August 2, 2015
 | author = Cooper Quintin | publisher = [[Organization:Electronic Frontier Foundation|Electronic Frontier Foundation]]
}}</ref>  Many of the unmaintained devices would need to be rooted, which violates the terms of many wireless contracts. Therefore, the nature of Stagefright bug highlights the technical and organizational difficulties associated with the propagation of Android patches.<ref name="zdnet" /><ref>{{cite web
 | url = http://www.androidcentral.com/stagefright-exploit-what-you-need-know
 | title = The 'Stagefright' exploit: What you need to know
 | date = July 27, 2015 | access-date = July 29, 2015
 | author = Phil Nickinson | publisher = Android Central
}}</ref>

As an attempt to address the delays and issues associated with the propagation of Android patches, on August 1, 2015 Zimperium formed the ''Zimperium Handset Alliance'' (ZHA) as an association of different parties interested in exchanging information and receiving timely updates on Android's security-related issues.  Members of the ZHA also received source code of the Zimperium's proof-of-concept Stagefright exploit before it was publicly released.  {{As of|2015|08|06|df=US}}, 25 of the largest Android device OEMs and wireless carriers have joined the ZHA.<ref name="zimperium-detector" /><ref name="zimperium-zha" /><ref>{{cite web
 | url = http://www.tomshardware.com/news/zimperium-stagefright-vulnerability-detector-app,29770.html | title = Zimperium Releases Stagefright Vulnerability Detector
 | date = August 6, 2015 | access-date = August 25, 2015
 | author = Lucian Armasu | publisher = [[Tom's Hardware]]
}}</ref>

== Mitigation ==
Certain mitigations of the Stagefright bug exist for devices that run unpatched versions of Android, including disabling the automatic retrieval of MMS messages and blocking the reception of text messages from unknown senders.  However, these two mitigations are not supported in all MMS applications (the [[Software:Google Hangouts|Google Hangouts]] app, for example, only supports the former),<ref name="zimperium-protection" /><ref name="zdnet" /> and they do not cover all feasible [[Attack vector|attack vector]]s that make exploitation of the Stagefright bug possible by other means, such as by opening or downloading a malicious multimedia file using the device's [[Software:Web browser|web browser]].<ref name="cert" /><ref>{{cite web
 | url = https://www.blackhat.com/docs/us-15/materials/us-15-Drake-Stagefright-Scary-Code-In-The-Heart-Of-Android.pdf
 | title = Stagefright: Scary Code in the Heart of Android – Researching Android Multimedia Framework Security
 | date = August 5, 2015 | access-date = August 25, 2015
 | author = Joshua Drake | website = blackhat.com
 | pages = 31&ndash;39
}}</ref>

At first it was thought that further mitigation could come from the [[Address space layout randomization|address space layout randomization]] (ASLR) feature that was introduced in [[Software:Android Ice Cream Sandwich|Android&nbsp;4.0 "Ice Cream Sandwich"]], fully enabled in [[Software:Android Jelly Bean|Android&nbsp;4.1 "Jelly Bean"]];<ref name="cert" /><ref>{{cite web
 | url = https://www.duosecurity.com/blog/exploit-mitigations-in-android-jelly-bean-4-1
 | title = Exploit Mitigations in Android Jelly Bean&nbsp;4.1
 | date = July 16, 2012 | access-date = July 31, 2015
 | author = Jon Oberheide | website = duosecurity.com
}}</ref>  The version of [[Software:Android Lollipop|Android&nbsp;5.1 "Lollipop"]] includes patches against the Stagefright bug.<ref name="fortune" /><ref>{{cite web
 | url = http://www.androidpolice.com/2015/07/28/google-representative-promises-a-stagefright-security-update-for-nexus-devices-starting-next-week/
 | title = Google Promises a Stagefright Security Update For Nexus Devices Starting Next Week
 | date = July 28, 2015 | access-date = July 31, 2015
 | author = Michael Crider | website = androidpolice.com
}}</ref>
Unfortunately, later results and exploits like [https://github.com/NorthBit/Metaphor Metaphor] that bypass ASLR were discovered in 2016.

As of Android 10, software [[Codec|codec]]s were moved to a [[Sandbox (computer security)|sandbox]] which effectively mitigates this threat for devices capable of running this version of the OS.<ref name="cert" /><ref>{{cite web
 | url = https://android-developers.googleblog.com/2019/05/queue-hardening-enhancements.html
 | title = Queue Hardening Enhancements
 | date = May 9, 2019 | access-date = September 25, 2019
 | author = Jeff Vander Stoep, Android Security & Privacy Team and Chong Zhang, Android Media Team | website = android-developers.googleblog.com
}}</ref>

== See also ==
* [[Engineering:Android version history|Android version history]]{{snd}} a list and descriptions of the released versions of Android
* Another MMS [[Arbitrary code execution|remote code execution]] vulnerability was found in 2020 for Samsung Android 8.0 (Oreo) to 10.x (Q) smartphones CVE-[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8899 2020-8899]

== References ==
{{Reflist|40em}}

== External links ==

* {{YouTube|id=PxQc5gOHnKs|title=Stagefright demo by zLabs}}, August 5, 2015
* [https://www.exploit-db.com/platform/?p=android Exploits database for the Android platform]
* [http://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-19997/Google-Android.html CVE security vulnerabilities for the Google Android]
* Google's Android codebase patches against the Stagefright bug: [https://android.googlesource.com/platform/frameworks/av/+/030d8d0%5E!/ patch #1], [https://android.googlesource.com/platform/frameworks/av/+/5c134e6%5E!/ patch #2] and [https://android.googlesource.com/platform/frameworks/av/+/0e4e5a8%5E!/ patch #3]

{{Hacking in the 2010s}}
{{Malware}}
{{Android}}

[[Category:Android (operating system)]]
[[Category:Computer security exploits]]
[[Category:Software bugs]]

{{Sourceattribution|Stagefright (bug)}}