Comment by stevenh | Hacker News Reader

Comment by stevenh | Hacker News Reader

Any competent malware developer must have already figured out how to exploit this the first time around. Now that every single one of those malware developers has learned it is still exploitable, the payload they've spent the past month perfecting can now be deployed in the wild.

So, can someone explain why a disastrous worm hasn't already swept the globe and infected 99% of Android devices on the planet within ten minutes of being released in the wild?

1. Text payload to victim

2. Payload executes on victim's phone and texts itself to all of the victim's contacts

3. Repeat

Assuming the average Android phone owner has 20 contacts who also have Android phones, and assuming also that texting the payload to those 20 people would take two minutes to complete, the infection would spread exponentially and only take ten minutes for the initial text to result in the infection of 10 billion devices worldwide.

Why am I not currently being bombarded with MMS video texts from infected devices? It frankly seems a bit miraculous. Did Google set up an emergency arrangement with all of the carriers to block suspicious video texts so this wouldn't happen?

The carriers are already blocking messages that match this pattern. That's why you haven't seen widespread exploitation.

https://twitter.com/jcase/status/628327791713517570

However, this only works in the US when you have 6 carriers. I have no idea what the situation is like elsewhere with massive carrier fragmentation.

It's not often that Android's fragmentation is touted as a benefit, but the fact that Android isn't a monoculture is certainly one of the hurdles to developing a worm capable of mass deployment. Supposedly the varying implementations of the Android media services mean a libstragefright exploit may or may not end up with root access.

Now, if this were an iOS zero-day exploit...

[Actually, it'd be trivial for the carriers to filter the payload, so I don't reckon SMS/MMS is ever going to be a viable transmission vector.]

Yes, I believe the payload have to be tailored pretty much exclusively for each type of device. But, I doubt that would stop anyone trying. Company phones are often the same type and model, someone with a certain target in mind could probably put in the hours.

do carriers already have a mechanic in place to trigger precautions a message matching worm-like patterns (similarity, mass transmission)? or would they have to implement one after it's too late?

I'm afraid carrier don't care enough to do that. I hope I'm wrong.

I suspect the answer is something like this:

1. A worm would be highly visible and easily blocked by carriers

2. There's no easy way to make more money from a mass worm than you could make from lower-profile, more-targeted attacks. You could ask a billion people to send you a dollar but that'd leave a paper trail anyone could follow.

3. The more widespread it is, the more pressure there is on vendors & carriers to ship patches for old devices

Apparently the exploit doesn't work on devices that have good ASLR (based on a /. comment by someone who works on the Android security team).

Because, despite the hype, the bug doesn't give full root access to the phone.

>So, can someone explain why a disastrous worm hasn't already swept the globe and infected 99% of Android devices on the planet within ten minutes of being released in the wild?

There are a couple of reasons:

1) Just because you have an exploit it doesn't guarantee you'll be able to execute code because you still need to bypass ASLR. The PoC's released do not do this.

2) Infecting phones with malware is very rare. The "tech pundits" like to scare the public, but the reality is that smartphones are rarely infected. Besides, the people that write and distribute malware are too busy infecting Windows machines.

Correct, most malware infections of mobile devices are targeted attacks for espionage etc.

1. Maybe it's not as easy as you think.

2. The MMS system isn't as anonymous as the Internet and someone didn't want to burn an identity making this worm.

3. A combination of 1 and 2, where the people with technical skill to do this would only use it on specific targets.

From what I've read, and could be wrong, is you could be infected and not even know it. The attacker has the opportunity to "clean up" the MMS so you never even get a notification because the bug is before any of that kicks in.

Still, we'd see a bunch of reports from non-Android phones receiving MMS's from infected Android contacts.

I've received an MMS unexpectedly from one of my contacts. (I'm on Android)

With selinux (as most android phones 4.4+ have) I imagine an exploit is not possible.

Didn't a number of texting apps, possibly including hangouts, update to fix it separate of this botched fix?

EDIT: I just checked and sure enough my texting app, QKSMS, updated to remove the Stagefright library

No, apps cannot remove system libraries responsible for processing video. What your MMS app did was disable the auto-retrieval of MMS messages.

It can't remove the system libraries, but it can decide not to use them. Yes, this means if you were to open it with any app that isn't protected then you will still be vulnerable, but within the app you're safe.

Source: I wrote QKSMS

Uh no, it disable the stagefright library... disabling MMS auto-retrial is something else that I also did, but QKSMS also removed the ability for the app to interface with the Stagefright Libraries

Reply on news.ycombinator.com