Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

12:15 PM
Connect Directly

There's Another Android Media Vulnerability, But Google Isn't Worried

Vulnerability could become a favorite of ransomware operators, but Google has left it unpatched for more than two months.

Days after a critical vulnerability in the Stagefright multimedia playback engine broke headlines -- and maybe opened a new era in Android threats -- Trend Micro has gone public with another vulnerability affecting the way Android handles multimedia files. Researchers believe that the unpatched bug -- which Google has known about for over two months -- may become a popular in for mobile ransomware.

The vulnerability is in the Android mediaserver service used to index media files, and affects Android versions 4.3 (JellyBean) to 5.1.1 (Lollipop), which amounts to over half Android devices in use today.

According to researchers, it can "render a phone apparently dead -- silent, unable to make calls, with a lifeless screen."

Exploits may be delivered through either a specially crafted website or a malicious app. Mediaserver then cannot correctly process malformed video files, which causes the service to crash, "and with it, the rest of the operating system." If the screen was locked, it cannot be unlocked. If the malicious app is written to auto-start whenever the device boots up, it would cause the OS to crash again every time the device is turned on.

According to Trend Micro: "Whatever means is used to lure in users, the likely payload is the same. Ransomware is likely to use this vulnerability as a new 'threat' for users: in addition to ... the device being encrypted, the device itself would be locked out and unable to be used. This would increase the problems the user faces and make them more likely to pay any ransom."

Researchers reported the vulnerability to Google May 15; Google labeled it low-priority May 20 and has not yet provided a patch. No exploits have yet appeared in the wild.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Author
8/3/2015 | 5:27:33 PM
What does this mean for BYOD Enterprise Users?
This vulnerability will have serious implications when it comes to how corporate administrators will provide access into their networks/applications going forward. Traditional controls like MDM are most efficient when there is a baseline of "trusted" device types, typically used when evaluating devices entering a trusted network. In this case (and Stagefright), while there may be availabie fixes, providers are lagging in making it available to actual users essentially leaving these devices unprotected.

Corporate administrators without a proper remediation will likely begin to remove all access to network resources on a broader scale until they can validate their network is not introducing this risk within their organization. That means the "flexibility" and "availability" touted by BYOD programs will be essentially nill.

User Rank: Ninja
7/30/2015 | 12:48:31 PM
High Priority
Seems like a pretty high priority to me. Have they labeled it as low due to the lack of data in the wild? Now that it has had public release it will most likely become more prevalent.
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-17
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS Build 20210202 and later Q...
PUBLISHED: 2021-04-17
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia C...
PUBLISHED: 2021-04-16
jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDe...
PUBLISHED: 2021-04-16
jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDe...
PUBLISHED: 2021-04-16
Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows forging a valid JWT. The issue will be patched in the upcoming 5.2.1 release.