yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] wkwkwk:
It's quite strange how little information (apart from the media sensationalism) there is about this.

Saying that, is there a way to fix 4.4.4 (OmniROM)? I obviously have root access.

Are the build.prop fixes for 5.0 only or are they valid for 4.4.4 as well?

Thank you.
[Android Q&A, Help & Troubleshooting] draken101:
Yeah if you download a build.prop editor from the play store (Note obviously it needs root) then it allows you to search for stagefright and shows you all the lines of code. The build.prop editor I have only allows you to change the variables from true to false so you can't really mess up by making a typo lets say. Then it needs to reboot to commit the changes. If you do it on the phone, with a build.prop editor app using root SU access, then all your permissions should be fine. Don't be copying files to pc then back to your phone again after editing, that apparently will give you boot loops. Which aren't nearly as nice as fruit loops yoh :highfive:
[Android Q&A, Help & Troubleshooting] josephmicah:
Thanks, Draken 101! :highfive! Can you tell me what functionality I will lose by doing this?
[Android Q&A, Help & Troubleshooting] xtermmin:
Is there a way to tell if this simple build.prop edit actually disables stagefright?

Also, the news is all over the "MMS" aspect, but is there any other "surprising" way that this exploit works? Like, would a web page with an exploited image (opened with Chrome, Opera (old and new), Firefox Mobile, etc) be vulnerable?

(Basically, how far does stagefright actually extend into the system?) Pretty far, apparently.
[Android Q&A, Help & Troubleshooting] mihai.apostu98:
I think I found more informations about how exploit works:

"The details will be released on the 5th of august. However, on the Cyanogenmod github repository there are*several interesting details that appear to be related: it appears that certain fields in 3GPP video metadata are vulnerable to buffer overflow attacks. In short, a 3GPP video can be given a string of metadata that, at first, exceeds a certain length, and in the end includes machine code that lands in memory that is off-limits to the application." - Chavez

Source: http://security.stackexchange.com/q...the-stagefright-vulnerability-work-on-android

Source 2: https://github.com/CyanogenMod/android_frameworks_av/commit/57db9b42418b434751f609ac7e5539367e9f01a6
[Android Q&A, Help & Troubleshooting] USMC retired:
darn

I have it also, it's showing up as lib files, perhaps it's designed to intrude on a specific apk? I tried a full wipe but no go, it's burrowed in somehow

EDIT: OK, this is weird, doing another search so I can tell you all more info, and now root explorer can't find the exploit. Can anyone tell me why people do this sort on nonsense?
[Android Q&A, Help & Troubleshooting] ProfEngr:
According to Xposed, PropEditor requests access to your phone's serial number in addition to what comes up in the Store permissions before install. Meh, denied.

In Hyperdrive RLS19 (4.4.2) there's also:

lpa.use-stagefright

which I set to false.
[Android Q&A, Help & Troubleshooting] DAC324:
No StageFright in build.prop?

I've got none of these entries (nothing containing "stagefright" at all) in my build.prop file. What am I supposed to do now? Is it necessary to amend them?

Android version 4.4.2 on a Doogee Valencia DG800

Kind regards,

DAC324
[Android Q&A, Help & Troubleshooting] ocd_amp:
How would one apply this patch? Using a patched libstagefright_amrnb_common.so ? I would like to post this fix for an abandoned Custom 2.3 ROM Also an abandoned Cyanogenmod 11 ROM but is used by many.
[Android Q&A, Help & Troubleshooting] Cullenator:
You could write them in and set them to false, just to be sure.

NOTES:

Use a build.prop editor app and make sure you back up the original build.prop first. Also, double-check your spelling to ensure there are no typos. Messing up your build.prop could result in a bootloop.

Without the full disclosure of the vulnerability, nobody has been able to test this fix. It has not been confirmed that this will indeed protect you from the stagefright vulnerability; but it seems like it could be a viable workaround until a patch is released for your firmware.

This may affect performance on streaming video with your phone, but so far, I haven't noticed any on my LG G3 Cat.6.
[Android Q&A, Help & Troubleshooting] esgie:
Great job!

Tested on Touchwiz-based Kitkat 4.4.2 on a tablet. System seems stable. MMSs working fine. No exploit in the wild, no verification atm, however.

The problem is that i found only a part of your pattern and then i've noticed that above instructions were placed in a slightly different way in my file. The push instruction was absent at all. The lsls instruction (which is identical between examples) was in a different place between the remaining instructions.

Changed the appropriate bytes (three at all) in the remaining ones. At least it seem that nothing wrong happened since now.

If this is the fix then it really may be easily portable!
[Android Q&A, Help & Troubleshooting] EEngineer:
Always happy to see me adage proven, Real programmers program in assembly.

if proven, could this be released as an XPosed Framework module?
[Android Q&A, Help & Troubleshooting] ProfEngr:
Yeah. Could have done that. Blocked it through Xposed though. No biggie. Typical Store missing/hiding app permission requests.

Still remains to be seen if this actually blocks the malware code being executed in the background anyway.
[Android Q&A, Help & Troubleshooting] oootooo:
noob question

Can't it be fixed just by preparing a MMS with "exploit" repairing the bug? :confused: In my humble opinion it would be logical :)
[Android Q&A, Help & Troubleshooting] voxluna:
This is how I proposed Google Play Services could repair it, even if it wasn't internally able to do so itself. I know for sure they can remove apps remotely, and I'd be surprised if there is nothing they can do to access root in order to patch the system. It may not be something that's public, but then again, Play Services et al. are not open source.

Nonetheless, from what I've read so far, Google has only indicated that they've provided patches to manufacturers, and hasn't said (yet) they will do this by remote means. That doesn't preclude it from happening, I suppose... but it'd be an enormous undertaking. Basically all 900 million phones with the vulnerability.

---------- Post added at 07:08 PM ---------- Previous post was at 07:00 PM ----------

*hangs head* No they were not.
[Android Q&A, Help & Troubleshooting] E.N.:
Using an exploit to patch is not realistic because each phone is setup differently. A buffer overrun hack usually will do some damage to the system in order to insert a worm, so they can't just push a patch through the vulnerability and claim the collateral damage was worth it.
[Android Q&A, Help & Troubleshooting] voxluna:
Right, I would not expect them to do it, it's just a theoretical mechanism -- there are scores and scores of device types. But I really doubt they are going to do patching of any sort directly in the first place, no matter what the avenue. That's always been on the manufacturers to implement, and carriers to distribute.
[Android Q&A, Help & Troubleshooting] Nidstang:
I find it interesting that the devs over at Textra SMS apparently believe they can come up with "a rock solid solution" to Stagefright -- see here and here.

This has to be an overstatement, insofar as non-MMS vectors are concerned. But I am intrigued as to what they may be able to do in the app itself as far as the MMS vector goes . . .
[Android Q&A, Help & Troubleshooting] voxluna:
"In other SMS / MMS apps, turning off auto-retrieve is **NOT** enough as once you tap 'download' the exploit becomes active. Additionally you would not get any MMS pics or group messages."​

Well, that much is certain. If all you can do (i.e. unrooted) is turn off auto-retrieve, you must vet all incoming messages by trust level, and even then, it's possible your trusted friend/colleague has been hijacked and is sending you those nastygrams.

"We are working on a rock solid solution for 'StageFright' in Release 3.1 of Textra out this week."​

My guess would be they implement StageFright internally, by either using the source code and patching it (possible) or writing their own routine (doubtful). But it would certainly be a definitive feature if they did.
[Android Q&A, Help & Troubleshooting] z_thompsonpa:
More Info Found

I've disabled the following in my build.prop and I haven't noticed any adverse side effects.

media.stagefright.enable-player=false
media.stagefright.enable-meta=false
media.stagefright.enable-scan=false
media.stagefright.enable-http=false
media.stagefright.enable-fma2dp=false
media.stagefright.enable-aac=false
media.stagefright.enable-qcp=false
lpa.use-stagefright=false

I've also disabled MMS and Hangouts Auto Retrieve. I am still able to download MMS attachments after the change. Thanks!

I've been doing some research and found this:

It appears to be a "fuzzing" framework for stagefright. It mentions different CVE's from what I have read from the recent articles floating around, but appears to be the same exploits applied to stagefright CLI.

It was also discovered before recent articles regarding stagefright. (announced March 23rd @ Android Builders Summit)

It looks like VulnDisco Exploit pack has a recent update:

One could also examine the Cyanogen Mod commits and (with enough knowledge) reverse engineer a workable exploit:

FWIW, after disabling stagefright with build.prop method:

$ stagefright
/system/bin/sh: stagefright: not found
$ su
# stagefright
tmp-mksh: stagefright: not found
# find / -name *stagefright* -type f
/system/lib/libstagefright.so
/system/lib/libstagefright_amrnb_common.so
/system/lib/libstagefright_avc_common.so
/system/lib/libstagefright_chromium_http.so
/system/lib/libstagefright_enc_common.so
/system/lib/libstagefright_foundation.so
/system/lib/libstagefright_omx.so
/system/lib/libstagefright_soft_aacdec.so
/system/lib/libstagefright_soft_aacenc.so
/system/lib/libstagefright_soft_amrdec.so
/system/lib/libstagefright_soft_amrnbenc.so
/system/lib/libstagefright_soft_amrwbenc.so
/system/lib/libstagefright_soft_flacenc.so
/system/lib/libstagefright_soft_g711dec.so
/system/lib/libstagefright_soft_gsmdec.so
/system/lib/libstagefright_soft_h264dec.so
/system/lib/libstagefright_soft_h264enc.so
/system/lib/libstagefright_soft_mp3dec.so
/system/lib/libstagefright_soft_mpeg4dec.so
/system/lib/libstagefright_soft_mpeg4enc.so
/system/lib/libstagefright_soft_rawdec.so
/system/lib/libstagefright_soft_vorbisdec.so
/system/lib/libstagefright_soft_vpxdec.so
/system/lib/libstagefright_soft_vpxenc.so
/system/lib/libstagefright_wfd.so
/system/lib/libstagefright_yuv.so
/system/lib/libstagefrighthw.so

Of course, I didn't try all of this before I made the change. Either way, I'm convinced that the CLI tool does not exist on non-developer devices.

On a side note, I mentioned this to a co-worker and he uses the Textra app. As mentioned above, it appears they will patch before the end of the week:

So it is as they say... lots of apps using these libraries internally so the build.prop method may not work for those particular apps. In the case of some apps there may be no way to disable auto receive.

Hopefully this helps those looking for more information about the exploits.
[Android Q&A, Help & Troubleshooting] DANIEL TAN:
This may be a dumb question but I am really curious to know if this exploit affects those video players like mx player and vlc since they did use stagefright for HW decoding?
[Android Q&A, Help & Troubleshooting] voxluna:
Well, I expect this exploit has rather wide-ranging implications for any app or process that makes use of StageFright. So that's not a stupid question. If they did in the past, and those versions haven't been updated... well there's your answer.

---------- Post added at 09:30 PM ---------- Previous post was at 09:26 PM ----------

I guarantee someone's figured it out. It would serve their purpose to keep quiet and propogate this myth that it's not in the wild yet.

And that goes for government entities as well. The NSA must be buzzing right now, what with a brand new vector to assault targets with. Assuming they haven't known about this

all along

. They do have the most brilliant mathematicians in the world, after all.

Ut oh, now I'm on a list somewhere....
[Android Q&A, Help & Troubleshooting] xtermmin:
Googleing "stagefright mx player" brings up a few pages that make it seem like MX Player doesn't use it at all, and uses its own internal framework for media.

A non-stagefright-based internal framework might be what other messaging apps like Textra might be looking to implement.

EDIT: Hm, or maybe not. This older AOSP post says otherwise. Might depend on the file type. If it's something that stagefright can handle, MX Player might pass it off. If not, it might try to use internal framework. Wonder if using a custom codec will keep it from ever passing it off to stagefright.
[Android Q&A, Help & Troubleshooting] DANIEL TAN:
My sentiments exactly, and now the issue seems to be a lot worse to me. :(

As far as I know, linking to stagefright is the only way to implement HW decoding right now. Therefore, I am pretty sure mx player does use it in their bundle. Look here for their open source part and you will find stagefright is included in the package.
[Android Q&A, Help & Troubleshooting] USMC retired:
none

Where is the build.prop file, using root browser where would it be located at?

Thanks
[Android Q&A, Help & Troubleshooting] reddogtrf:
Possible first ever attack?

Hi All, I have just heard from someone who worked as a tester in Melbourne Australia for the banking industries that some of their colleagues have been attacked via the MMS Stagefright exploit. Security in those places would be pretty serious I would have guessed, and if this is true, it's already out in the wild. I have instructed him to request his affected colleagues to report it to Google.

Don't wish to alarm you all, and I could not verify whether the attack is related or not. But he was pretty convinced the attack was what's described in the media. Given he is a tester, I would just have to take his words for it.
[Android Q&A, Help & Troubleshooting] DoRiLoN:
I recieved an email (not a mms or sms) from the following adress: xxxxx@mmsc.o2online.de (the X's are an unknown number, o2 is the german provider) with a text intended for a friend of mine, no multimedia or any other attachments, thoug. Should I be worried?
[Android Q&A, Help & Troubleshooting] RealDogBoy:
You have nothing to worry about. This vulnerability can only be triggered by video attachments. And I still haven't heard of any confirmed reports of working exploits.
[Android Q&A, Help & Troubleshooting] lion7718:
Chomp released an update this morning that is supposed to protect MMS.
[Android Q&A, Help & Troubleshooting] Cullenator:
Avast just released an article on this saying that all you have to do is disabled auto retrieve, FWIW: https://www.avast.com/en-us/faq.php?article=AVKB230#artTitle
[Android Q&A, Help & Troubleshooting] voxluna:
I could see it happening. Sadly, once this exploit was announced, and particularly because patches had been committed for later inclusion, it was only a matter of time before someone figured it out and started using it. I guarantee it.
[Android Q&A, Help & Troubleshooting] USMC retired:
Nice find, good lookin out, thanks

---------- Post added at 07:38 PM ---------- Previous post was at 07:36 PM ----------

Hey Vox, how are you? get your phone back up? Although at times my phone acts strange in build.prop I see nothing of the word StageFright, nor do I see the CEV codes that would indicate certain infection, that being said, if I reboot my phone instead of the boot animation being smooth and flowing, it stutters pathetically, don't know what this means.

---------- Post added at 08:01 PM ---------- Previous post was at 07:38 PM ----------

Hi All

ChompSMS has patched their sms app from running StageFright, fingers crossed, you will see the explanation when you search PS for it
[Android Q&A, Help & Troubleshooting] Nidstang:
Textra also has an update available, looks the same as the Chomp setting above (which makes sense, think the same company makes both apps).
[Android Q&A, Help & Troubleshooting] mathuaerknedam:
Isn't this exactly the sort of thing (malicious video) that anti-malware programs are supposed to protect us against!? I guess Avast is at least being obliquely open about their inability to protect. I realize it may not be entirely their fault (at least on an unrooted phone), but why isn't the security software up to the task?
[Android Q&A, Help & Troubleshooting] zelendel:
Because it is done on a system level. And to be honest most Antivirus software is nothing more then fearware. Most of the time completely useless.
[Android Q&A, Help & Troubleshooting] voxluna:
A T-Mobile OTA patch?

FWIW: I was chatting with an agent at T-Moble yesterday, who said he had received an OTA on his Galaxy S6 that T-Mobile released to plug StageFright. I didn't quiz him very much about it, so its veracity is up in the air. Of course, I imagine most people on here are not in the habit of accepting OTAs. But I thought I'd throw this out there into the rumor mill.
[Android Q&A, Help & Troubleshooting] philip.majewski:
The "official" patches:

github.com/CyanogenMod/android_frameworks_av/commits/cm-12.0

by jduck

android-review.googlesource.com/#/c/162630/

Sorry, i cannot post outside links!

Some more details on stagefright:

blog.trendmicro.com/trendlabs-security-intelligence/mms-not-the-only-attack-vector-for-stagefright/

I have serious doubts, but i hope its possible to fix the stagefright through Xposed Framework. It would be the simplest, universal way, because 50-80% devices out there will never see the official OTA update (like my wifes galaxy s2 on 4.1.2 jb).

And let say its clear, MMS is only one of couple attack vectors for stagefright.

Opening prepared links in android internal browser, chrome or opera are another attack vector.

Now, when the patches for stagefright are open source and public, you can expect to stagefright exploits going wild.

Until an fix will be given for rooted users (like the stagefright library compiled with patchs), better install the latest Firefox and use it instead of Chrome.

And i think, better don't download any video files in these days (torrent, extrapornfordroid, happyfappening and many more important sites can wait)
[Android Q&A, Help & Troubleshooting] USMC retired:
Yikes

My Nexus 6 has deteriorated to the point where it will not even run a stock Nexus ROM, it's AOSP or i'm dead in the water, the radio won't work, it freezes, and the boot animation as opposed to being smooth flowing is very shall we say stuttered.

I have no idea if this due to the exploit, build.prop shows no sings of stagefright at all while on a AOSP ROM, so not sure what to think at this point.
[Android Q&A, Help & Troubleshooting] mathuaerknedam:
While it would be nice for a security tool to be able to protect against a system insecurity, that's clearly not the only avenue available for protection. Otherwise there would be no mitigation available in apps.

Why can't the security apps (with root) block textra, opera, or mxplayer from calling stagefright?
[Android Q&A, Help & Troubleshooting] voxluna:
Arrrrgh, I was afraid of that. The only upside to this is that maybe if I switch to Firefox, it won't bring my entire system to its knees on LP.

I see your priorities are in the right order here. ;)

---------- Post added at 04:16 PM ---------- Previous post was at 04:07 PM ----------

You're saying if you flash AOSP it works okay, but not with stock? That would indeed be extremely odd, and the lack of StageFright in your AOSP would tend to bear this out. I don't know how well an exploit can survive a wipe, but I suppose it's possible... root can survive OTA sometimes.

That's a rather exotic theory though, I'd lean towards some kind of hardware issue. It would be a crappy exploit that took over your system and made it unusable, thereby drawing attention to itself. But I haven't heard of any StageFright "detectors" yet -- your standard anti-rootkit app is probably not going to see it, not by name at least -- so there may be no way to know at this point.
[Android Q&A, Help & Troubleshooting] RealDogBoy:
That sure sounds like a hardware problem. You must be under warranty -- right?

I hope you got the N6 from Google or Motorola. I've heard nothing but good things about their warranty service. Carrier warranty service is another matter.
[Android Q&A, Help & Troubleshooting] USMC retired:
Indeed, that's what I thought as well, I was on Mikey's ROM which is a stock ROM, and I could make a call, but no sound at all in the earpiece, another not so welcome caviat is this. When I make a nand, do a full wipe then restore the nand, it bootloops, but if I completely reflash everything i'm fine. A mystery to say the least.

I will stay on AOSP until the patch comes out and see what that does, but if I unroot and relock for warranty purposes can I get the stock ROM to boot up and function is the question.

---------- Post added at 04:59 PM ---------- Previous post was at 04:55 PM ----------

I think there is a one year warranty on the devices....yes? But, do I risk relocking, unrooting only to find out that the stock ROM won't run? then have to do the docey-doce all over again, there are rare times, but rare, when I question if rooting is really worth it, but those are just fleeting thoughts. :D:eek:

EDIT: Just for Giggles I tried to put a stock ROM back on, the red, green, blue and yellow dots have been flying around for about 20 minutes, rewiping and reflashing. Next up you ask? To also wipe internal storage if I can find the needed files to put back into internal storage so the phone has a brain
[Android Q&A, Help & Troubleshooting] RealDogBoy:
Yeah, it's a one-year warranty so you have at least a few months to decide whether or not to send it back. If it won't run after being flashed back to a stock factory image, that sounds like a hardware problem (and I don't think it was likely to have been caused by flashing any custom rom.)
[Android Q&A, Help & Troubleshooting] USMC retired:
Edit Edit; Flashed a stock rom and it works great, at this point you probably think i've had 20 beer's but i am at a lost for words, lastnight it was just going bonkers, relief I tell ya
[Android Q&A, Help & Troubleshooting] voxluna:
[MENTION=3780753]musicman625[/MENTION] Almost certainly a misbehaving app then. It's interesting you didn't have those lines in your build.prop, though -- that seems to bear out that StageFright isn't mandatory for the system.
[Android Q&A, Help & Troubleshooting] rhe12:
After creating an image just in case, I used ES File Explorer in my rooted HTC One M8 to change what I found in my build.prop to:

media.stagefright.enable-player=false
media.stagefright.enable-http=false
media.stagefright.enable-aac=false
media.stagefright.enable-qcp=false
media.stagefright.enable-fma2dp=false
media.stagefright.enable-scan=false

With no adverse effects. Thanks. :)
[Android Q&A, Help & Troubleshooting] voxluna:
Important to note here, for people that don't read the whole thread: Make sure you edit any/all Stagefright entries you have, because they vary according to your Android version (and probably among phone models). Also, be sure to use a build.prop editor or other onboard method (like you just described), unless you want this to happen. And yes,

backups backups backups

.

I was conflicted about repeating this information, but the latter parts are crucial to avoiding total meltdown....
[Android Q&A, Help & Troubleshooting] lunburger:
I made a backup of build.prop and manually remounted system read-write via adb and used vi to edit the above 6 stagefright lines to false but also edited

lpa.use-stagefright=false

Rebooted and everything seems fine

With these edits in place, would it be ok to have MMS autodownload enabled?