Cyber-security firm Zimperium on Monday warned of a flaw in the world's
most popular smartphone operating system that lets hackers take control
with a text message.
"Attackers only need your mobile number, using
which they can remotely execute code via a specially crafted media file
delivered via MMS (text message)," Zimperium Mobile Security said in a
blog post.
"A fully weaponised successful attack could even delete the message before you see it. You will only see the notification."
Android code dubbed "Stagefright" was at the heart of the problem, according to Zimperium.
Stagefright
automatically pre-loads video snippets attached to text messages to
spare recipients from the annoyance of waiting to view clips.
Hackers
can hide malicious code in video files and it will be unleashed even if
the smartphone user never opens it or reads the message, according to
research by Zimperium's Joshua Drake.
"The targets for this kind
of attack can be anyone," the cyber-security firm said, referring to
Stagefright as the worst Android flaw discovered to date.
"These vulnerabilities are extremely dangerous because they do not require that the victim take any action to be exploited."
Malicious code executed by hackers could take control of smartphones and plunder contents without owners knowing.
Stagefright imperils some 95 percent, or an estimated 950 million, of Android phones, according to the security firm.
Zimperium
said that it reported the problem to Google and provided the California
Internet firm with patches to prevent breaches.
"Google acted
promptly and applied the patches to internal code branches within 48
hours, but unfortunately that's only the beginning of what will be a
very lengthy process of update deployment," Zimperium said.
It did not appear as though hackers had taken advantage of the Stagefright vulnerability, according to Zimperium.
Updating
Android software powering mobile devices is controlled by hardware
makers and sometimes telecommunication service carriers, not Google.
While Apple controls the hardware and software in iPhones, iPads, and iPods
powered by its mobile operating system, Google makes Android available
free to device makers who customize the code and update it as they see
fit.
More about Drake's research was to be disclosed at a Black
Hat computer security conference taking place in Las Vegas early in
August.
Samsung Galaxy S24, Galaxy Z Flip 6 Tipped to Get Android 16-Based One UI 8 Beta Next Week23 June 2025
Search
