I am currently updating my Android phone (a Moto G) to Lollipop 5.1. I previously had taken action to prevent Stagefright from happening to my phone (setting multimedia messages to only manual downloads). The update said that Lollipop 5.1 included a fix for Stagefright. I am wondering what this fix is and if my phone is now completely safe from Stagefright (i.e., I can set multimedia messages to automatic download again).
You can use Zimperium's Stagefright Detector app to test your device for the known attack vectors. The bugs were not patched upstream until Android 5.1.1, but it is possible (particularly based on the change notes) that Motorola backported security fixes to their 5.1 release, so the version of Android you have is not necessarily the best indicator.
NB: One of Zimperium's researchers is Joshua Drake, who disclosed the Stagefright vulnerabilities to Google and submitted patches to fix them. It is therefore reasonable to conclude that the tests in their app are more than likely accurate.
It's not based on the version of Android you have. Because Stagefright is a core library in Android framework and was found to be known after Android 5.1 was released.
But it's based on OEM's releasing the patch for Stagefright. Motorola have been posting the updates in their forum that it will soon release a patch for its users and ways to mitigate the issue till you receive the updates. Since you have Motorola Moto G and YES, Motorola has officially released the patch for the security vulnerability known as "Stagefright"(in the libstagefright media framework) after Google reported to Motorola in the late June and as it has been mentioned in the Motorola forum that and its support website,
After Google informed us in late June, we've been working to integrate, test and deploy the security patches into all future products and software updates. We are also working with Google and our carrier partners to simplify the process of deploying critical security updates in the future.
The mentioned in the Motorola forum post,
We have started deploying software with StageFright patches across the globe, with more in the pipeline. Here is a list of devices with new software in either full or staged rollout. (Note: this list may be incomplete -- I'll update as new information becomes available.)
And the updates are released to the public to the following devices,
- Moto G 1st Gen – EMEA/India Retail
- Moto G LTE 1st Gen – Brazil Retail
- Moto G 1st Gen – Brazil Retail
- Moto X 1st Gen – Brazil Retail/Telcel Mexico
- Moto X 2nd Gen – Brazil Retail
- Moto E 4G 2nd Gen – Asia Retail
- Moto G 2nd Gen – US Retail
- Moto G 2nd Gen – Brazil Retail
- Moto G 3rd Gen – Retail Brazil
- Moto G 2nd Gen – India
- Moto E 1st Gen – Brazil/India/US Retail
After appying this update you can feel secured from the Stagefright issue. But you never know there will be a new security issues everyday. So please keep your device software up-to-date.
I have a Xiaomi Mi Max, which uses MIUI 8, which is based on Android 6 dot something. It totally fails the stagefright detection test. Chinese manufacturers pay next to zero attention things like this. Aging the firmware (and worn out irreplaceable batteries) is their primary means of giving their products an intentionally shortened lifespan. So what I do is make darn well sure that none of the messaging apps I use, ever have the setting to automatically download MMS media content. I also make sure I never browse any questionable website. Firefox supposedly has a safety guard that prevents using the libstagefright that avoids the problem, but I don't know if the Chrome browser, which I prefer, is safe (supposedly) as well.