A new Android bug discovered by a security researcher allows hackers to break into the device by simply sending an MMS or a multimedia file. The hacked device’s features, including camera and external storage, can then be accessed. In some cases, hackers may even be able to gain root access.
The fault was first discovered by Joshua Drake from the security firm Zimperium.
The exploit starts infecting a device once the user receives a text message.
“This happens even before the sound that you’ve received a message has even occurred,” Drake said. “That’s what makes it so dangerous. [It] could be absolutely silent. You may not even see anything.”
Drake is also the co-author of Android Hacker’s Handbook.
The malware is embedded in a short video sent to the user’s phone. Once it reaches the device, “it does its initial processing, which triggers the vulnerability,” Drake says.
According to NPR, Hangouts – the messaging application – processes videos instantly and saves them automatically in the phone’s gallery. This arrangement allows the malware to enter the phone without the user having to open the file.
However, using the phone’s default messaging application is “a tiny bit less dangerous.” In this case, one would have to open the text message before processing the attachment. Nevertheless, “it does not require in either case for the targeted user to have to play back the media at all,” Drake says.
(Also read: Android Phones Can Be Hacked With Just 1 Text)
In an interview with Forbes, Drake said, “I’ve done a lot of testing on an Ice Cream Sandwich Galaxy Nexus… where the default MMS is the messaging application Messenger.
“That one does not trigger automatically but if you look at the MMS, it triggers, you don’t have to try to play the media or anything, you just have to look at it.”
PC World said, “The library is not used just for media playback, but also to automatically generate thumbnails or to extract metadata from video and audio files such as length, height, width, frame rate, channels and other similar information.
“This means that users don’t necessarily have to execute malicious multimedia files in order for the vulnerabilities found by Drake to be exploited. The mere copying of such files on the file system is enough.”
Collin Mulliner, senior scientist at Northeastern University, said, “In this case Google is not the actual one to blame. It’s ultimately the manufacturer of your phone, in combination possibly with your carrier.”
Security firm F-Secure reported that 99 percent of all mobile malware threats in the first quarter of 2014 were designed to run on Android-compatible phones.
Following the discovery, Google said in a statement, “We thank Joshua Drake for his contributions. The security of Android users is extremely important to us and so we responded quickly and patches have already been provided to partners that can be applied to any device.
“Most Android devices, including all newer devices, have multiple technologies that are designed to make exploitation more difficult. Android devices also include an application sandbox designed to protect user data and other applications on the device.”
You might also be interested in: Randy Johnson, Former Mariners Ace, Inducted Into Baseball Hall Of Fame