SafeUM
Home Blog Services Download Help About Recharge

Axarhöfði 14, 110 Reykjavik, Iceland

Iceland - 2015
SafeUM
Blog
Services
Download
Help
About
Recharge
Menu
Archive
TOP Security!
8 Sep 2016

Just one photo can silently hack millions of Android phones

Google released a bunch of Android patches today, covering off some previously-disclosed issues including the worrying Quadrooter bugs that affected 900 million phones.

But another, previously-unknown critical weakness has been covered too and you’ll want to download the patch now because the hack can be delivered hidden inside an innocuous-looking photo in a social media or chat app.

A victim wouldn’t even have to click on the evil photo: as soon as its data was parsed by the phone, it’d quietly let a remote hacker take over the device or simply brick it. The problem, according to the researcher who uncovered the vulnerability, resided in the way images used by certain Android apps parsed the Exif data in an image. Any app using a slice of Android code – the Java object ExifInterface – is likely vulnerable, said Tim Strazzere, from security firm SentinelOne.

Strazzere told me that as long as an attacker can get a user to open the image file within an affected app – such as Gchat and Gmail – they could either cause a crash or get “remote code execution”; ergo they could effectively place malware on the device and take control of it without the user knowing.

The problem was made even more severe as a malicious hacker wouldn’t even need the victim to do anything. “Since the bug is triggered without much user interaction – an application only needs to load an image a specific way – triggering the bug is as simple as receiving a message or email from someone. Once that application attempts to parse the image (which was done automatically), the crash is triggered,” Strazzere said. That’s not dissimilar to how the Stagefright exploits of last year ran.

“Theoretically, someone could create a generic exploit inside an image to exploits lots of devices. However, due to my skill level, I had to specifically craft each one for the devices. Though once this is done, Gchat, Gmail or social media apps would likely allow this to trigger.” The researcher wouldn’t reveal the names of the other, non-Google apps affected, other than to say they included “privacy-sensitive” tools.

Prior to the today’s update that provides patches for all versions of Google’s operating system from 4.4.4 up, older Android devices would have been in greater danger of an image-based hack. “Most of the newer mitigations in place made it quite difficult for me to get a stage working exploit that could work on multiple devices,” Strazzere said. “With this said, it was incredibly easy to cause the phone to become unusable (due to the mitigations) and go into endless reboots. There were even a few phones that somehow go bricked in this process, all from just receiving the corrupted image over Gmail.”

Another warning: Strazzere successfully tested his exploits on phones stretching back to a handful of Android 4.2 and Amazon devices. They may well remain unpatched, leaving users exposed. As Strazzere told me, if you’re not running an up-to-date operating system and/or device, it’s probably time to invest if worried about security. Google gave Strazzere $4,000 as part of its Android bug bounty and added another $4,000, as the researcher had pledged to give all $8,000 to Girls Garage, a building program and workspace for girls aged 9-13.

Android manufacturing partners were advised about Strazzere’s find – and the scores of other vulnerabilities detailed today – on 5 August or before. If concerned, check with your device maker to see when an update is on the way. Google Nexus phones running Android 4.4.4 and above should receive an over-the-air update today.

Tags:
Android information leaks
Source:
Forbes
1784
Other NEWS
3 Jul 2020 safeum news imgage An encrypted messaging service has been infiltrated by police
4 May 2020 safeum news imgage Two-Factor Authentication ​What Is It and Why You Should Use It
12 Dec 2019 safeum news imgage Encryption is under threat - this is how it affects you
4 Nov 2019 safeum news imgage Should Big Decisions Be Based on Data or Your Intuition?
7 Jun 2018 safeum news imgage VPNFilter malware infecting 500,000 devices is worse than we thought
4 Jun 2018 safeum news imgage Hackers target Booking.com in criminal bid to steal hundreds of thousands from customers
1 Jun 2018 safeum news imgage Operator of World's Top Internet Hub Sues German Spy Agency
30 May 2018 safeum news imgage US says North Korea behind malware attacks
29 May 2018 safeum news imgage Facebook and Google targeted as first GDPR complaints filed
25 May 2018 safeum news imgage A new reason to not buy these cheap Android devices
24 May 2018 safeum news imgage Flaws in smart pet devices, apps could come back to bite owners
23 May 2018 safeum news imgage Google sued for 'clandestine tracking' of 4.4m UK iPhone users' browsing data
21 May 2018 safeum news imgage LocationSmart reportedly leaked phone location data onto the web
18 May 2018 safeum news imgage The SEC created its own scammy ICO to teach investors a lesson
17 May 2018 safeum news imgage Thieves suck millions out of Mexican banks in transfer heist
All news
SafeUM
Confidential Terms of Use Our technologies Company
Follow us
Download
SafeUM © Safe Universal Messenger

Axarhöfði 14,
110 Reykjavik, Iceland

Iceland - 2015