SymmetricalDataSecurity: Epic Android Vulnerability

Tuesday, July 28, 2015

Epic Android Vulnerability – What does it mean for you?

Security researchers are reporting new, serious vulnerabilities that, they claim, affect 95 percent of the Android phones out there.

If that’s not alarming enough, according to the researchers, these vulnerabilities allow attackers to take complete control of your phone with zero interaction—you just need to receive a specially-made multimedia message (MMS).

They’re calling this cluster of vulnerabilities “Stagefright.”

The good news is the researchers say they have worked with Google and there are now fixes available.

But, and here’s where this situation gets much, much worse—there’s a catch.

In short, once more we are confronted with the ongoing quandary of if, when and how Android customers can get security fixes for their phone.

As I discussed last month, just because security fixes are available for Android doesn’t mean they’ll be available to your specific phone and version of the OS. And even when fixes are available, there are still questions around the ability to actually get them on your phone.

Based on this, what can you do to protect yourself? First, disable your phone’s MMS. Trend Micro researchers have shown that this can help protect against attempts to attack these vulnerabilities. So until you have a fix for this problem, that’s a good step to take. If you don’t use MMS, then you should disable that feature and keep it disabled. There’s no reason to keep something turned on if it isn’t used.

Taking the time now to disable a feature you don’t need or use is good advice in general as more security problems emerge and this precaution can prevent problems down the line. As we saw with Microsoft Windows, there can be serious security problems with multimedia files. Now, that attackers are turning their attention to multimedia files on Android, it’s very likely that we will see other problems like this in the future.

Sadly, this episode is only the latest reminder that Android is a platform with significant security challenges. As we reported in our Q1 2015 Threat Report, we saw Android malware and high-risk apps spike to the 5 million mark in March 2015.

This means that in addition to always running security software on your Android device, you should disable features and services that you don’t use or need, just like with Microsoft Windows.

How to Turn Off Auto-receive for MMS

One thing you can do to help protect yourself against the MMS (multimedia messages) vulnerability in Android, is to turn off the auto-receive for multimedia messages in your default messaging (text) application.

Here’s an example from a Samsung Note 3 smartphone, using Android 5.0 (Verizon is the carrier). Your default messaging/text application settings may differ.

1. To discover which app you’re using as your default messaging app, tap the Settings app on your Android device. The Settings screen opens.