Mobile security for Android users seems to be tough to achieve these days, especially when considering how the source code of the Stagefright Metaphor exploit has been released into the wild. NorthBit, the Israeli security company responsible for the publication of this code, mentioned how only Nexus 5 devices are vulnerable to the software in its current form. That being said, it is relatively easy to target any device by any manufacturer, and Bitcoin users will need to be more vigilant than ever for the time being.
Also read: Using Gamified Hacking Challenges To Attract New Blockchain Developers
Stagefright Metaphor Is Available on GitHub
Making such a high-potential threat available to anyone with Internet access is a strange decision on behalf of NorthBit, even though this should help security experts come up with countermeasures sooner rather than later. Despite only Nexus 5 smartphones with Android being vulnerable to the GitHub code itself, it won’t take internet criminals all that long to modify the code to their needs.
Speaking of changing the Stagefright Metaphor source code, the complimentary whitepaper released by NorthBit shows how it takes little effort to attack any Android device. Every single ROM running on a mobile Android device has its own lookup tables, which can be defined within the Stagefright Metaphor exploit code. For example, there is nothing preventing hackers from modifying the code and infect older generations of devices.
Although NorthBit CTO Zuk Avraham admits he has not tinkered with the source code and its defined lookup tables, it appears to be “child’s play” to do so. In fact, the Stagefright Metaphor exploit has been labeled as “usable and practical” by the Israeli security company, which is of even bigger concern to Android users all over the world.
Stagefright Metaphor can infect Android devices running operating system version 2.2 to 4.0, as well as 5.0 and 5.1. To put this into numbers, roughly 275 million devices can be targeted by Internet criminals looking to deploy this exploit en masse. However, any devices which have received a security patch on or after October 1, 2015, should be safe from harm, according to NorthBit.
Getting infected with Stagefright Metaphor is not all that hard, although users will need to visit a particular website loaded with infected .mp4 files. Regardless of whether the user opens these files or not, just accessing the site itself is enough to download and install the exploit. Hackers are – theoretically – able to perform remote code execution and privilege escalation as well.
A Major Concern For Bitcoin users With Older Devices
Although most Bitcoin users store their coins in a mobile wallet located on a more recent smartphone, there are a lot of people out there who use an older phone as a backup or cold storage solution. In fact, some Bitcoin wallets advise users to use a second Android device as cold storage, which could put these users at risk of getting infected with Stagefright Metaphor.
Anyone who is using an Android device running one of the vulnerable operating system versions needs to check for security updates manually or look for an alternative wallet solution for the time being. Granted, most of the community is well aware of this bug, and they will take the necessary precautions. But it never hurts to remind people of the danger Stagefright Metaphor poses.
What are your thoughts on NorthBit releasing the source code on GitHub? Will it become a threat to Bitcoin users? Let us know in the comments below!
Source: Tweakers (Dutch)
Images courtesy of Android Authority, Shutterstock