Android Stagefright Flaws Put 950 million devices at risk
https://threatpost.com/android-stagefright-flaws-put-950-million-devices-at-risk/113960
An attacker in possession of their target's phone number
could send an MMS or even a Google Hangouts message to an
affected device that triggers the vulnerability before the
victim has a chance to open the message. In some cases, the
attack would delete the MMS in question, leaving behind only a
notification that a message was sent ... There are some
mitigations, for example, in Google Hangout settings, a user is
able to request that MMS messages are not automatically
downloaded. "Older devices don't have that option, older
devices are more exposed and at risk," Drake said, adding that
exploits against Ice Cream Sandwich and Gingerbread are much
easier to develop and put those versions at extreme risk. "They
don't have the hardening measures Android has these days."
- - -
Apparently, here we go again. And unfortunately, very large percentages
of Android users are on older devices that neither Google nor carriers
can or will appropriately update. In fact, even getting Google to make
official statements and provide official "from the horse's mouth" help
center reference pages about such situations -- and possible mitigations
or workarounds -- is often simply impossible.
Google: I *realize* that this is hard stuff. I *understand* that the
openness of the Android ecosystem makes this difficult. But the
continuing status quo of security issues piling up on older devices that
are still being routinely used by vast numbers of users is simply
untenable. At the very least these users need to be directly informed
and helped *by Google* -- not left to pick up bits and pieces of often
inaccurate information from third party media and various Google
adversaries. It's bad for consumers, and it's bad for Google!
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
