Hacker News new | ask | show | jobs
by quicklime 3231 days ago
"Stagefright" is an Android vulnerability that allows attackers to exploit a device by sending a specially crafted MMS message. No user intervention is required, no dodgy apps need to be installed.

You're on Android 4, so your phone is vulnerable. If you use your phone for anything important, I'd suggest getting that new phone ASAP.
1 comments
throwaway613834 3231 days ago
Actually I've already mitigated this by disabling automatic MMS download, and from what I read [1] it can be mitigated in other ways as well. It can't be done in every app, but then you can just use an app that lets you do this. So this is a non-issue. Any others you can think of?

[1] https://en.wikipedia.org/wiki/Stagefright_(bug)#Mitigation

link
tinus_hn 3231 days ago
Just make sure not to open any videos from the internet. Hardly an issue!
link
throwaway613834 3231 days ago
> Just make sure not to open any videos from the internet. Hardly an issue!

What? Chrome and Firefox protect against it [1]... do you not use either?

[1] https://www.howtogeek.com/225834/stagefright-what-you-need-t...

link
veeti 3231 days ago
The app-level "mitigation" is that media isn't automatically loaded. You are still just as vulnerable after you decide to play that innocuous-looking MP4 file.
link
throwaway613834 3231 days ago
I wasn't aware, thanks for mentioning that. However, the videos I watch are on YouTube and news sites and such... not sketchy sites. And I never play MP4s on my phone directly (unless they're videos I've recorded). I'm not sure many others do either, frankly. So how much do I need to worry and how much of a justification is this to upgrade the phone every 1-2 years?
link
dmoy 3230 days ago
Right this is sort of the point. You were not aware, if you had based your defense against unlatched vulnerabilities based on your knowledge 24 hours ago, you could quite easily have gotten pwned. Knowing about all vulnerabilities that could affect you and how they work is incredibly difficult. I don't want that risk (nevermind that even if I was ok with that risk, my company would throw a fit if they found out I was using an unpatched OS).
link
djrogers 3230 days ago
> I never play MP4s on my phone directly

A good chunk of he video on the internet is mp4, so how would you know if you were playing an mp4 or not?

link