Stagefright Doc Detector App

Stagefright is a remotely exploitable software bug that affects versions 2.2 ("Froyo") and newer of the Android operating system, and allows an attacker to perform arbitrary operations on the victim device through remote code execution and privilege escalation.

Security researchers demonstrate the bug with a proof of concept that sends specially crafted MMS messages to the victim device and in most cases requires no end-user actions upon message reception to succeed, while using the phone number as the only target information. The underlying attack vector exploits certain integer overflow vulnerabilities in the Android's core component called "Stagefright", which is a complex software library implemented in C++ as part of the Android Open Source Project (AOSP) and used as a backend engine for playing various multimedia formats such as MP4 files.

The Stagefright bug was discovered by Joshua Drake from the Zimperium security firm, and was publicly announced on July 27, 2015. Prior to the announcement, Joshua reported the bug to Google in April 2015, which incorporated a related bugfix into its internal source code repositories two days after the report. In July 2015, Evgeny Legerov, a Moscow-based security researcher, announced that he found two similar heap overflow zero-day vulnerabilities in the Stagefright library, claiming that the library has been already exploited for a while. As of July 2015, the full public disclosure of the bug is announced for the Black Hat USA computer security conference on August 5, 2015, and for the DEFCON 23 hacker convention on August 7, 2015. The bug has been provided with multiple CVE identifiers, which are collectively referred to as the Stagefright bug.

As of August 3, 2015, only a few products have been actually patched against the bug: Blackphone's PrivatOS since its version 117, nightly releases of the CyanogenMod 12.0 and 12.1, Sprint's variant of the Samsung Galaxy Note 4, and Mozilla Firefox since its version 38 (this web browser internally uses Android's Stagefright library). While Google maintains the Android's primary codebase, firmware updates for various Android devices are the responsibility of wireless carriers and original equipment manufacturers (OEMs). As a result, propagating patches to the actual devices often introduces long delays due to a large fragmentation between the manufacturers, device variants, Android versions, and various Android customizations performed by the manufacturers; furthermore, many older devices may never receive patched firmware at all. Thus, the nature of Stagefright bug highlights the technical and organisational difficulties associated with the propagation of Android patches.

Certain mitigations exist for unpatched devices, including disabling the automatic retrieval of MMS messages and blocking the reception of text messages from unknown senders; however, these mitigations are not supported by all MMS applications (Hangouts, for example, supports the former one). Further mitigation comes from some of the security features built into newer versions of Android that may help in making exploitation of the Stagefright bug more difficult; an example is the address space layout randomization (ASLR) feature that was introduced in Android 4.0 "Ice Cream Sandwich" and fully enabled in Android 4.1 "Jelly Bean".
Thus, updating to the latest version of Android may help alleviate the issue, although as of July 28, 2015 it is unknown whether the latest releases of Android 5.1 "Lollipop" include actual patches against the Stagefright bug.