Stagefright security issue: what can a regular user do to mitigate the issue without a patch?

Question

There appears to be a giant security vulnerability with Android that seems to basically affect all phones. PC World wrote:

The vast majority of Android phones can be hacked by sending them a specially crafted multimedia message (MMS), a security researcher [Joshua Drake] has found.

...

Drake found multiple vulnerabilities in a core Android component called Stagefright that’s used to process, play and record multimedia files. Some of the flaws allow for remote code execution and can be triggered when receiving an MMS message, downloading a specially crafted video file through the browser or opening a Web page with embedded multimedia content.

...

The MMS attack vector is the scariest of all because it doesn’t require any interaction from the user; the phone just needs to receive a malicious message.

For example, the attacker could send the malicious MMS when the victim is sleeping and the phone’s ringer is silenced, Drake said. After exploitation the message can be deleted, so the victim will never even know that his phone was hacked, he said.

What can a regular user do to mitigate the issue? Disable Google Hangouts?

Answer 1

This is not just about MMS or web surfing, since Stagefright is the library that helps phones to unpack multimedia messages: see Media and this article on Fortune.

So it is about any application (including your web browser) that works with multimedia (video clips and audio records). MMS is just an easiest way to exploit it, because your phone will not ask you before downloading it.

That is why you also need to think about all other applications working with multimedia and never open any multimedia attachments before the fix is not installed on your phone.

For the Web browser, you could switch to Firefox 38 or higher, then you could continue opening web pages with video and/or audio content.

To summarise:

• Disable auto-retrival of MMS in your Messaging App (whatever it is) (Guide with images)
• Switch to Firefox 38 or later (find it in your market / app store)
• Switch to a filesystem manager hiding video thumbnails, which is the default for Total commander
• Switch to a video player that is immune, e.g., the video player MX player (make sure to activate its "HW+" setting for all video formats) pointed out by hulkingtickets

• Do not open any multimedia files or draw video thumbnails in any other applications and block automatic opening/downloading of them in all apps if possible. This is very important. If your phone is not patched and you use ANY app with multimedia content, and there is no option to block automatic opening of multimedia in this app (example for browser: if you open some random web page, you browser should preload videos, if they are on this web page), then stop using this app and block Internet access for this app (if you can't - delete the app). If this app is important to you, and you can't update phone firmware or block multimedia in this app, just stop using your phone and buy another one, which is not vulnerable.

  Yes, this means that in the worst case you need to change the phone. Stagefright is a very serious vulnerability affecting ~ 1 billion devices, so you could easily become a victim of automated attack, that is not done directly against you, but directed to all 1 billion users.

• Install updates, if you have Cyanogenmod 11 or 12 (fixed on 23.07.2015, see commits on github)

  EDIT: fixes from 23.07.2015 were incomplete, you may need to update again after fix on 13.08.2015

  EDIT 4: Fixes on 13.08.2015 were again incomplete, you need to update one more time after fixes from Google in October 2015 (so-called Stagefright 2.0). If you have Adroid 5.x or 6, you may need to update again after these next fixes from Google in November 2015, since there are similarly dangerous vulnerabilities (CVE-2015-6608 and CVE-2015-6609), that are probably not called Stagefright anymore. Please note, that the time of actual fix from your manufacturer could be later, or at least different. E.g., CM11 got updated on 09.11.2015, while CM12.1 got updated on 29.09.2015.

  EDIT 5: 2 more Stagefright vulnerabilities are reported by Google at 01.02.2016, however, they "only" affect Adroid 4.4.4 - 6.0.1

• Wait for update from your manufacturer

  EDIT2: Similar with Cyanogenmod, an update from your manufacturer could be not enough, due to the issue with initial integer overflow fix, that was reported on 12.08.2015: Original integer overflow fix ineffective. So even after update, it is recommended to check if your phone is still vulnerable using the App from Zimperium (finder of the Stagefright issue): Zimperium Stagefright Detector App

• If you already has root, try fix offered by GoOrDie. Also see this howto guide.

  EDIT 3. I tried this fix on Samsung S4 mini, and it did not work. So think twice before rooting your phone.

Answer 2

To mitigate this attack, I've disabled MMSes, since I don't use them anyway. You can do that in the Settings menu. Select Cellular Networks > Access Points Names, select your access point, and remove "mms" from APN Type. I've also cleared out MMSC.

_{(Click image to enlarge; hover the image to know the instruction)}

_{Order of Instructions: Follow images from left to right in each row}

Note that Android converts group SMSes to MMSes, so you might want to disable that too. To do that, go to the Messaging app, open the Settings menu, and disable Group Messaging and Auto-Retrieve.

Answer 3

The newest version of Hangouts mitigates this issue, it looks like it does some extra checks before passing the media on to the system service. It doesn't fix the underlying issue in the system, though.

You can also disable MMS auto-retrieve in Hangouts via its Settings → SMS → uncheck Auto retrieve MMS or in Messenger via its Settings → Advanced → disable Auto-retrieve under MMS. This site has detailed steps if you need them.

Answer 4

This issue affects web surfing too. Try disabling media.stagefright-related properties (if exists) in build.prop configuration file.

Mount root partition as rw and edit build.prop. Set media.stagefright.enable-### to false

Note: this requires root access.

Answer 5

Zimperium, the company that reported the vulnerability, has posted additional information about the vulnerabilities related to Stagefright.. In the Google Play Store, there is an application that will detect whether the vulnerability is present on your device. Apparently Samsung has also posted an app that will disable MMS on Samsung devices, though this is not in the Play Store.

Answer 6

As MMS(Multi-Media-Messaging) is one of multiple ways this exploit can be run, you can prevent this from MMS exploits. Stagefright on its own is not an exploit. Stagefright is a multimedia library built into the Android framework.

The exploit was found in a multimedia tool hidden at deep system level, so almost all Android variants that have the tool at their core could be easily targeted. According to Zimperium zLabs’ study, a single multimedia text has the ability to open up your device’s camera and begin recording video or audio, and also give hackers access to all your photos or Bluetooth. Fixing Stagefright would require a complete system update (which still hasn’t been reported to be released by any OEM), as the exploit is embedded to a system-wide tool. Fortunately, SMS app developers have already took the issue into their own hands and released temporary fixes to avoid Stagefright to gain automatic access to your device’s camera by stopping video MMS messages from running as they arrive. [Source - Android Headlines]

You could use Textra SMS or Chomp SMS from the Play Store which claims that it is capable of limiting this Stagefirght exploit. Both apps Textra and Chomp SMS developed by Delicious Inc. have both received brand new updates that limit how video MMS messages run as soon as they are received by your device.

From the Textra Knowledge Base article,

The stagefright exploit can occur when any SMS / MMS app creates the MMS video thumbnail that it shows in the conversation bubble or notification or if a user presses the play button on the video or saves to Gallery.

We have provided a solution for 'StageFright' in Release 3.1 of Textra out now.

Very Important: In other SMS / MMS apps, turning off auto-retrieve is NOT enough as once you tap 'download' the exploit potentially becomes active. Additionally you would not get any MMS pics or group messages. Not a good solution.

According to the developer of both the apps,

the risk of your device being targeted to this new exploit is greatly decreased by denying MMS messages the ability to automatically run.

How can I protect from Stagefright using Textra?

Turn on the Stagefright Protection under your Textra app Settings.

_{Screenshot (Click to enlarge image)}

So here is what happens if you activate the app's Stagefright Protection and if you receive a Stagefright exploit message,

1. Stagefright Protected: As you can see below, the message was not downloaded and the thumbnail hasn’t been resolved, so if this video has an exploit targeting Stagefright then it will not yet be able to execute its code. The message has a nice “Stagefright Protection” label beneath it.

_{Screenshot (Click to enlarge image)}

2. What happens if I click the Stagefright Protected message? : When you hit the Play button on the MMS message: an even bigger box, with an even bigger play button, and an even bigger “Stagefright” label.

_{Screenshot (Click to enlarge image)}

3. Do you still want to open the Media and get affected? : Finally, clicking the Play button one last time will bring up a nice warning message reminding you that downloaded videos may contain an exploit called Stagefright.

(Note: there is no known exploit, and if there were its name wouldn’t be Stagefright as Stagefright is simply the name of the multimedia library that is vulnerable to being exploited).

_{Screenshot (Click to enlarge image)}

Pressing the OKAY button will then bring up whichever video you were going to view, and that’s it. If said video actually did contain an exploit that targets Stagefright then it would, in fact, execute at this moment.

Source : Phandroid

If you are curious about whether you are already affected and a victim of Stagefright exploit then download this app Stagefright Detector from PlayStore which was released by zLabs(Zimperium research labs) which first reported the issue to Google.

Updated: [18-09-2k15]

Motorola has officially released a security patch for Stagefright security issue on August 10 to the carriers for testing and it's release to the public based on the carrier provider. It is mentioned in the forums that,

As soon as a patch is ready you will see a notification on your phone to download and install the update. We encourage everyone to periodically check if they have the latest software by checking in Settings>About Phone>System Updates.

And if you using Motorola and still din't get the security patch you can read the following to avoid the security risk of under attack,

What can I do to protect myself if my phone does not have the patch? First, only download multimedia content (such as attachments or anything that needs to be decoded to view it) from people you know and trust. You can disable your phone’s capability to download MMS automatically. That way you can only choose to download from trusted sources.

• Messaging: go to Settings. Uncheck “Auto-retrieve MMS.”
• Hangouts (if enabled for SMS; if greyed-out, no need to take action): go to Settings > SMS. Uncheck auto retrieve MMS.
• Verizon Message+: go to Settings > Advanced settings. Uncheck Auto-retrieve. Uncheck “Enable weblink preview.”
• Whatsapp Messenger: go to Settings > Chat settings > Media auto-download. Disable all video auto downloads under “When using mobile data,” “When connected on Wi-Fi” and “When roaming.”
• Handcent Next SMS: go to settings>Receive message settings. Disable auto retrieve.

Read more on :

How to protect from stagefright vulnerablility?
What are the other attack vectors for Stagefright?

Answer 7

The ad-ware MX Player claims to play videos without stagefright-related bugs. You need to select all grayed buttons and all blue-checked buttons shown on these images:

You will also need to clear defaults of all Video Player apps, then select MX Player as the default Player app.

Disclaimer: This App comes in two versions: one free with ads, and the other "Pro" for 6.10€. I am not related to its authors. I will get no revenue from this post. I may only get a certain amount of rep points.

Thanks to hulkingtickets for the idea of this very answer.