'Heartbleed for Mobile': Researcher Finds Massive Security Flaw in Android (Updated)

Openness is Android’s greatest strength — a flexibility that has enabled it to spread to now power four of every five smartphones on the planet.

But openness can be, at times, its greatest weakness. This frailty was demonstrated on Monday when Joshua Drake, a researcher with security firm Zimperium, revealed a hole in Android’s source code that hackers can exploit with profound ease: If they have a phone’s number, all they do is send a text. The bug, dubbed “Stagefright,” houses the “the worst Android vulnerabilities discovered to date,” the company wrote.

It’s a particularly malicious hack because it can compromise the device quietly, unbeknownst to its owner. And for Google, fixing it largely falls outside its control.

“This is a Heartbleed for mobile,” said Chris Wysopal, the CTO of Veracode, referencing the formidable security bug that surfaced last year. “It’s sort of the Holy Grail of attacks on phones, where there’s no user interaction.”

Google confirmed the flaw’s existence, and said it has notified its hardware and telecom partners. It does not appear that any Android devices have suffered the hack as of yet.

“We thank Joshua Drake for his contributions,” a Google spokeswoman said in a statement. “The security of Android users is extremely important to us and so we responded quickly, and patches have already been provided to partners that can be applied to any device.”

It’s those multitudinous partners that leave Android particularly vulnerable. Unlike Apple, Android pushes out its updates to device manufacturers, who are then obliged to implement them. Apple has faced similar vulnerabilities in the past, but has staved them off recently through its tighter grip on the OS, said Wysopal.

While Android has attempted to exert more control on the hardware in recent years, it still must manage many moving parts at once. Security flaws, like Stagefright, are particularly frustrating for Google, since it needs to rely on partnering telcos and handset-makers, who are often slower on the uptake.

Drake, the researcher, wrote that the Stagefright bug affects Android versions 2.2 and above. Other security analysts suggest that iterations older than Jelly Bean version 4.2, which typically run on low-end Android devices, are more vulnerable since they lack much of the security infrastructure built into the later versions.

Wysopal suggested that Google may need to deploy a blanket solution. The time it may take to patch such a bug, he said, leaves a window for hackers to seize the hole. “The hardware manufacturers and the carriers have been really slow, and not nearly as quick as Google has been,” he said.

Google’s responsiveness is part of a broader move to bolster the security credentials within Android, particularly with its “sandbox” application — software meant to isolate the code and data in individual apps from one another. “Most Android devices, including all newer devices, have multiple technologies that are designed to make exploitation more difficult,” the company added in its statement.

HTC sent the following statement to NPR: “Google informed HTC of the issue and provided the necessary patches, which HTC began rolling into projects in early July. All projects going forward contain the required fix.” T-Mobile told Re/code it is working with phone makers to fix the bug as well.

We reached out to the other major carriers and large Android manufacturers, Samsung and Motorola, and will update if they respond.

Drake plans to unveil his full research on Stagefright at the Black Hat USA conference in August.

Update: Verizon echoed the statement from T-Mobile. A rep for Motorola sends word that Google informed them of the bug in June, and that it has integrated the corrective patch in many recent Lollipop (the most recent Android) upgrades and will extend it to all ASAP.

Also, Google, for its part, is playing even more defense. It put out this statement late Monday eve:

As part of a regularly scheduled security update, we plan to push further safeguards to Nexus devices starting next week. And, we’ll be releasing it in open source when the details are made public by the researcher at Black Hat.

And if you care to get really deep in the weeds, Adrian Ludwig, Android’s chief security engineer put out a lengthy Google+ statement. Without naming Stagefright outright, he clearly hints that the buzz around the bug is alarmist. “[T]he research community today,” Ludwig wrote, “is incentivized to find lots of bugs rather than to test exploit mitigation technologies, so it can be difficult to know if exploitation of bugs is actually possible.”

This article originally appeared on Recode.net.

Will you support Vox’s explanatory journalism?

Most news outlets make their money through advertising or subscriptions. But when it comes to what we’re trying to do at Vox, there are a couple of big issues with relying on ads and subscriptions to keep the lights on:

First, advertising dollars go up and down with the economy. We often only know a few months out what our advertising revenue will be, which makes it hard to plan ahead.

Second, we’re not in the subscriptions business. Vox is here to help everyone understand the complex issues shaping the world — not just the people who can afford to pay for a subscription. We believe that’s an important part of building a more equal society. And we can’t do that if we have a paywall.

So even though advertising is still our biggest source of revenue, we also seek grants and reader support. (And no matter how our work is funded, we have strict guidelines on editorial independence.)

If you also believe that everyone deserves access to trusted high-quality information, will you make a gift to Vox today? Any amount helps.

One-Time Monthly Annual

$5/month

$10/month

$25/month

$50/month

Other

$

Yes, I'll give $5/month

Yes, I'll give $5/month

We accept credit card, Apple Pay, and Google Pay. You can also contribute via