yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] rudolfm:
Here is what I figured out what a non root could do:

1. Disable MMS automatic download in all apps that handle SMS

2. Usw Firefox and in about:config set stagefright.disabled to true.

3. Usw MXplayer as your default Video handler

http://stackoverflow.com/questions/13947015/how-to-use-stagefright-in-android

Otherwise I couldn't find much useful information in the www.
[Android Q&A, Help & Troubleshooting] L.F.B.:
Factory images already out for nexus devices...

Anyone please know what have been changed? That should be an xposed fix for it. Too much trouble reflash an image just for this fix..
[Android Q&A, Help & Troubleshooting] zelendel:
It's an update for the stagefright vulnerability that everyone has been talking about. It also most likely has changes to the art runtime so xposed might not work, but then it might. I have no reason to update myself.
[Android Q&A, Help & Troubleshooting] L.F.B.:
Me too... Like said in android police:

This isn't a fix, it is a whole new image of the latest operating system. A fix would be applicable whichever version of android you were using. I do not want lollipop, and like kitkat 4.4.4.

Google is forcing lollipop through our throats... Thats not right! :(
[Android Q&A, Help & Troubleshooting] voxluna:
Google beginning to push "libstagefright" fixes this week

Here's something quite interesting that was just published today at Gizmodo: "Google's Fixing the Hangouts Hack With 'Biggest Software Update Ever'"

Regarding the so-named libstagefright hack, "Google’s fixing it — and fast. Right now, updates are being pushed over the air to the entire Nexus line that will stop the messenger app from preloading assets like malware embedded videos. (Good idea!) Millions of non-Nexus phones will get the same update this week." (emphasis mine)
[Android Q&A, Help & Troubleshooting] Cerberus_tm:
Interesting. So does that mean that they are not fixing the Stagefright bug itself, but are just focusing on stopping messenger apps from auto-loading videos? That would be strange?
[Android Q&A, Help & Troubleshooting] voxluna:
Yeah, I'm not entirely certain about this. The wording does suggest that's exactly how they're going to plug the MMS hole, but then I read a few posts above here that entire Nexus images are being shipped. I also don't know how many other "non-Nexus" phones these fixes will pertain to. But in the grand scheme of things, this is a pretty remarkable turnaround for any kind of large scale effort.
[Android Q&A, Help & Troubleshooting] RealDogBoy:
I found this article in The Verge which gets into how an exploit could work and why it's difficult to actually run a malicious piece of code reliably.
[Android Q&A, Help & Troubleshooting] L.F.B.:
This is very interesting and show how some things get oversized without real confirmation...
[Android Q&A, Help & Troubleshooting] Cullenator:
Zimperium (the firm that found the bug) has posted a Stagefright Detector App here: https://play.google.com/store/apps/details?id=com.zimperium.stagefrightdetector

Even after modding build.prop, it still says my phone is vulnerable. :( I wonder if it is actually testing if it can run stagefright code, or if it's just checking my software version against some db to see if I have the patch? Can anyone get it to pass?
[Android Q&A, Help & Troubleshooting] zelendel:
I was gonna let this go but couldnt help letting people in on something. Buildprop edits will not do anything. This is far deeper then the build prop. IT is built into the base coding of the OS.

So please people dont think that doing anything to the build prop will effect anything.

Also dont worry about it to much. The normal person has less then a .01% chance of being targeted, unless you are dub enough to post your phone number on Social network sites or on open forums for things like whatsapp invites (even less wise)
[Android Q&A, Help & Troubleshooting] Cullenator:
Thanks! I guess that confirms what the vuln checker app was saying.

You're right that it is probably unlikely that someone would actually be personally targeted with this attack, but remember that SMS isn't the only attack vector. Chrome users and users of other unpatched browsers (everyone except Mozilla, AFAIK) are still at some risk.

Thankfully, we do have ASLR as of Android 4.0, so the risk of an attacker hitting something critical is less likely, but not completely impossible of course.
[Android Q&A, Help & Troubleshooting] zelendel:
To be honest, if you use the internet you are vulnerable. Security is only as good as the hacker trying to get in. We see this all the time here. Just look at how devs bypass bootloaders and other security measures. Even Knox is not immune.

As long as you are smart then its no big deal really. ITs things like this that security companies use to fear monger people into thinking they need antivirus software.

I have never had a virus on any device and have never run any software for anti virus that wasnt MS security center which I normally shut off if I remember right.
[Android Q&A, Help & Troubleshooting] rudolfm:
FYI the detector APP contains a few mp4 files which it uses for testing. It dies not olny look at Version numbers.

My tablet with CM12.1 is not vulmerable, all my other devices are.
[Android Q&A, Help & Troubleshooting] neptun2:
Interesting that my xperia m4 aqua is not vulnerable and It uses android 5.0 while other sony devices already updated to 5.1.1 (z3/z2) are vulnerable. It looks like not only the OS version is important.
[Android Q&A, Help & Troubleshooting] Miche1asso:
It depends. The bug is vulnerable via Web browsing or could be embedded in an app. A very malicious hacker could well put a video in a web site that after triggering the bug will send itself via MMS to the whole address book (and then do something else very nasty to the phone, like wiping the whole /data directory). People receiving it would see the MMS from a known user and may click on the video, sending itself again to dozens/hundreds of recipients. Actually the MMS doesn't even need to be opened, just received.

Given its exponential nature it could potentially turn down millions of Android phones in few minutes. We are more or less all interconnected. As long as our phone number is in someone else address book we are vulnerable.
[Android Q&A, Help & Troubleshooting] Vardion:
Unfortunately, that substitution doesn't match on my S4's libstagefright_amrnb_common.so (Samsung stock 4.4 rom). Would replacing the shared lib with a patched version from another release (CM12 or whatever) work, or were there major changes in this library from 4.4 to 5.0/1?
[Android Q&A, Help & Troubleshooting] lunburger:
Zimperiums stagefright detector still reports as vulnerable :(
[Android Q&A, Help & Troubleshooting] Vardion:
Dis the substitution match in your case? Did you compare the library before and after the substitution whether they were different?
[Android Q&A, Help & Troubleshooting] oootooo:
I downloaded Zimperium's scanner app and it looks like I'm vulnerable only to CVE-2015-3829 and CVE-2015-3827, the rest seems ok. Does it mean my phone was partially patched by the producer before the news about stagefright leaked? I received official update to kk in July.
[Android Q&A, Help & Troubleshooting] Cullenator:
Thanks for the insightful logic! That's like saying, "Oh, if you get hit by a semi truck, you'll most likely die regardless, so don't bother wearing a seatbelt."

I've always had AV software on every device I ever owned, but thankfully none of my devices has ever been infected a virus. But that doesn't mean I'm going to uninstall my AV software, because nowadays, your security doesn't just depend on "If you're smart." All of your friends and family have to "be smart" too, or they could unknowingly send you malware, or accidentally download it to your computer or tablet if you let them borrow it. Anecdotal support: once my sister-in-law opened a happybirthday.zip attachment from someone she didn't know on my brother's computer. It took him several days to get rid of the virus.

Of course security solutions are not 100% effective, but the whole point of security is threat mitigation. I understand that of course, we will always be vulnerable in some way or another, but there are measures we can take to protect ourselves from known threats, or at least minimize the damage they can cause. It's not that we're all irrationally freaking out here, we're just trying to find ways to avoid a known, serious threat.
[Android Q&A, Help & Troubleshooting] zelendel:
It's not that serious. You have less then. 001% chance of being targeted unless you post your phone number openly on the Internet. (dumb)

Why would she open a zip from someone she doesn't know?

It's not that serious. You have less then. 001% chance of being targeted unless you post your phone number openly on the Internet. (dumb)

Why would she open a zip from someone she doesn't know?

As for pc anti virus understand I'm the only techy person in my family and the rest shouldn't be allowed to use a pc at all lol. So I get where you are coming from but in the end, the anti virus software never picks up the biggest issues. Just have to be smart. And as for letting someone use my pc/phone, yeah right not happening.
[Android Q&A, Help & Troubleshooting] Cullenator:
Again, MMS is not the only way the Stagefright vulnerability can be exploited, it's just the most hyped one because it requires no user input. You could also get it from streaming a video off of the internet. That's why Mozilla patched Firefox as soon as they heard about the vulnerability.

The chances of being infected (one vector of risk) is low right now, but now that the vuln has been disclosed, it's a matter of time before someone releases it into the wild, which will, of course, increase the risk factor. But the risk is already higher because of the second vector of risk, the impact of a successful attack, makes it more serious.

It's unlikely that I would let someone steal my phone and gain access to my email accounts, but I still have a pattern lock on my phone (even though it probably isn't too difficult to bypass). That's because even though the likelihood of an attack is low, the impact of someone getting a hold of my phone and unlocking it would be a pretty bad situation.

I still wouldn't have opened a zip file because I know better, but she didn't know that zip files could be dangerous at the time. It was also partly due to some unfortunate timing: it was her birthday recently and the subject line had something like "Happy Birthday! Your friend has sent you an e-card", and the message looked fairly convincing (no obvious typos, nice clean formatting). That's my point. You can't guard against someone else being fooled by coincidental timing (or even worse, deliberate targeting). It is even possible that you yourself could fall for a cleverly crafted attack.

I understand your skepticism of the current mobile antivirus offerings, given their inability to protect against issues like this. That's why I'm looking for another solution, like the build.prop mod (which, of course, didn't work). And yeah, I try not to let anyone else touch my phone, even if I'm showing them pictures. (Lollipop app pinning FTW!)

---------- Post added at 10:56 AM ---------- Previous post was at 10:55 AM ----------

Back to the subject, though...

I've heard MX Player is OK because it uses its own library to process streaming videos, but haven't verified this. Can anyone verify this?
[Android Q&A, Help & Troubleshooting] AP2FTW:
does anyone know what this stagefright patch does that zimperium released? is it as simple as just flashing that zip in twrp and i dont have to worry about this anymore?

i found it in this article https://blog.zimperium.com/stagefright-vulnerability-details-stagefright-detector-tool-released/

https://s3.amazonaws.com/zhafiles/Zimperium-Handset-Alliance/ZHA-Stagefright-Patches.zip
[Android Q&A, Help & Troubleshooting] rudolfm:
If you compile your own Rom then these are what you need. Sorry.

---------- Post added at 08:33 PM ---------- Previous post was at 08:31 PM ----------

Read my post in page 9 and habe a look at the link in my post.
[Android Q&A, Help & Troubleshooting] Cullenator:
Cool! These are actually source code change files. If you compile your own ROM from source code, you can use these to patch the source code and recompile, but AFAIK this isn't something you can just flash using TWRP (or any other recovery).

http://android.stackexchange.com/questions/63431/what-are-patch-files-in-android
[Android Q&A, Help & Troubleshooting] lulli1:
Google updated the stock firmware for nexus Devices. this new firmware is still online and ready to flash. it containes the stagefright patch.... for all nexus device owners the best way to be safe and secure.
[Android Q&A, Help & Troubleshooting] ocd_amp:
There has to be some kind of universal fix for every device so everyone from Gingerbread+ can have it.
[Android Q&A, Help & Troubleshooting] zelendel:
Some device s are not going to get the fix I hate to say. Mainly with devices more then 2 years old in the states. The carriers have already removed everything for those devices from their systems. I am betting we will see many devices left out in the cold for this as the only fix will be an os update.
[Android Q&A, Help & Troubleshooting] mathuaerknedam:
Zimperium reported on July 30 (9 days ago) that they believe that this is being exploited in the wild. In the same post, they write "Zimperium’s Mobile Threat Protection customers are safe from this threat, even without updating the device to the latest Android version." If they are to be believed, this confirms that Android security software *can* protect from the Stagefright exploit. Trend Micro claims to offer "a layer of protection", but I interpret that as meaning "probably better than nothing".

This article on The Hacker News provides a good high-level description of the non-mms attack vectors. For more detail, read Trend Micro's report.
[Android Q&A, Help & Troubleshooting] AP2FTW:
oh i see, thanks for the info

was this pushed to nexus devices or does it have to be installed manually? (wondering about the nexus 10 specifically)
[Android Q&A, Help & Troubleshooting] lulli1:
https://developers.google.com/android/nexus/images#instructions
[Android Q&A, Help & Troubleshooting] josephmicah:
Looks like you have to work for a company who has purchased an license to obtain Zimperium protection. Anyone no a work around for that?
[Android Q&A, Help & Troubleshooting] psychotropic:
Disabling Stagefright via build.prop broke the GPS functionality of my Weather Underground app. I live in Dillingham, AK and almost always, the app knows exactly where I'm at, even knows when I'm in small villages I sometimes travel to. Immediately upon disabling it, the Weather Underground app would only show my network location as Anchorage. Re-enabling Stagefright via build.prop allowed my Weather Underground app to use my GPS location again. I really like this app, but obviously can't leave my phone vulnerable.

Maybe Stagefright handles more than just media, e.g. plays some role in access to location services? Could also just be the Weather Underground app tries to use Stagefright, realizes it can't and kicks itself into some form of safe mode. Either way, the connection between Stagefright being enable or disabled clearly correlated to whether or not my Weather Underground app would use GPS location or not.
[Android Q&A, Help & Troubleshooting] zelendel:
It does. That's why the build prop edit have been proven not to be any protection at all. They do nothing about the exploit. The only real protection is updating the code and changing the mms apk.

Could always just come to Anchorage lol
[Android Q&A, Help & Troubleshooting] psychotropic:
Oh, but Anchorage isn't nearly as fun for this adventurous mental health professional! Though I do miss having an LTE connection when I do get the chance to go. Finding a rooted update solution to Stagefright and mms.apk is going to be pretty important to me as I'm not sure if GCI will be rolling out updates as quick as the larger carriers of the lower 48.
[Android Q&A, Help & Troubleshooting] zelendel:
I wouldn't count on them rolling it out at all as GCI uses euro based devices for alot of them. That's why I never stay stock.
[Android Q&A, Help & Troubleshooting] psychotropic:
That's what I gathered. On the flipside, GCI never seems too invasive about your usage either, so I guess I'd rather have a friendly mobile provider vs a big brother-ish one who aggressively updates.

I'll just keep my eyes peeled for a custom solution.
[Android Q&A, Help & Troubleshooting] zelendel:
Well let me know if I can be of help.
[Android Q&A, Help & Troubleshooting] voxluna:
Well, there are other vectors besides MMS, because this thing is really entangled. But yes, Zimperium's app certainly didn't care that I had changed build.prop at all -- it still shows some vulnerability. It was worth a try, I guess.
[Android Q&A, Help & Troubleshooting] Camacha:
Can you please provide the link to the article where this has been proven? Thanks!
[Android Q&A, Help & Troubleshooting] zelendel:
Read any of the articles and then just check the changeless for the aosp updates that fix it.
[Android Q&A, Help & Troubleshooting] Camacha:
I do not think anyone is claiming the build.prop edit will fix the bug, it should only disable Stagefright so it cannot do harm any more (or at least as easily). Do I understand correctly there is not really proof either way?
[Android Q&A, Help & Troubleshooting] zelendel:
It's in the source code for the update. That's the best i can advise. The problem with a build prop edit is that it can't completely stop it and can be bypassed. You need root to even change it and that in itself opens up security holes. The build prop loads upon booting and then serves no other purpose. So the only real proof would be to try and hijack a device and watch what happens.
[Android Q&A, Help & Troubleshooting] Camacha:
True, the leak will still be there. With a bit of luck it should be a lot harder to abuse though, especially when used together with the other precautions (turn off all automatic loading, use a safe browser, remove MMS settings). If the malicious code cannot find a way to be executed even if somehow loaded by an app, it would be a massive improvement.

That would be most interesting to see :) I think someone earlier in this thread did a small test with an exploit kit, but it would be very useful to see a more comprehensive test. I guess that will be hard until the exploit is roaming in the wild, or available under controlled circumstances. I see a job for tech sites, since a lot of users will be dependent on tweaks like these.
[Android Q&A, Help & Troubleshooting] AP2FTW:
my stock unrooted nexus 10 got a security update pushed to it today :good:
[Android Q&A, Help & Troubleshooting] Camacha:
We could really use some background on how the Zimperium tester app works. If it actually tests anything, interventions should show effect, though it seems more like the app looks for certain indicators and signals vulnerable or not based on that.

It would be good to know for sure though.
[Android Q&A, Help & Troubleshooting] zelendel:
It only checks somethings. It's already been said that it doesn't show vulnerable after the new update from Google even though the system is still vulnerable.
[Android Q&A, Help & Troubleshooting] voxluna:
I would posit, with little evidence though, that the scanner is only looking for the presence of these files on the system (or perhaps certain codecs, etc), versus whether or not anyone can actually exploit the various CVEs. It's not like it can use exploits to check directly, because there would be a variable output based on ASLR.

But I'm reluctant to agree that changing permissions might affect it, because when I posted the build.prop lines originally, someone linked directly to that post in an XDA article. To which I just sent a lengthy PM detailing why that's not a great idea.

Unfortunately, I think the only way to find out is to make a Nandroid backup and play with it, to see what happens. Such is the cost of the bleeding edge. ;)
[Android Q&A, Help & Troubleshooting] Charlie R.:
I did move them into an inaccessible subdirectory. No impact on the scanner.
[Android Q&A, Help & Troubleshooting] mathuaerknedam:
Today I experimented with a few "stagefright checkers" from Google Play, and two things stood out..

1. When I tried to run the checkers from Eset and Trustlook, McAfee warned me that each "is an exploit". I was warned that the Zipernium checker was a "medium threat risk". I received no warnings for the checkers by Lookout, Michael Kohl, or TheAndroidDevelopersCH. I also tested with Trend Micro, AVG, Avast, CM, 360, AndroHelm, TrustGo, BitDefender, DR Web, Eset, Kaspersky, Malwarebytes, Norton, Trustlook, AhnLab, Avira, Sophos, Ikarus, Zoner, F-Secure, PSafe, and Comodo, but they displayed no warnings. It's interesting that McAfee only warned on execution, not when scanning the APK.

2. The Michael Kohl "Stagefright Checker" checks only build.prop values. It reported that my system was "not protected" and displayed enabled stage fright build.rob values. This is despite the fact that those values (in fact, nothing with "stagefright") do not actually occur in my build.prop.

Addendum: After all the testing, I reinstalled McAfee just to see if I'd get the same results as before. Surprisingly, I did, mostly. This time McAfee flagged the Zipernium and Eset Stagefright checkers during the iniitial filesystem scan in addition to the on-execution runtime scan for each app. For some reason, Trustlook wasn't considered an exploit this time.

This single datapoint is inadequate for making a generalization, but it does suggest that, unlike the others, McAfee may actually provide some value. In a few weeks my wife will be borrowing my phone for a trip. I'll leave McAfee installed, just in case.
[Android Q&A, Help & Troubleshooting] mathuaerknedam:
Not to be pedantic, but the vulnerability can be "exploited" even if the checker/malware can't accomplish anything useful. I may not be using the correct security lingo here, but the point is to avoid/mitigate/fix the vulnerability despite the fact that ASLR will probably prevent our phones from being hacked. Right now ASLR is protecting us, but perhaps next month a clever malfeasant will find a way to use the stagefright problem while avoiding ASLR. A primary goal of any security is to reduce exposure to potential problems regardless of whatever additional protections provided by more "internal" tools.

Most of the available Stagefright checkers don't disclose how they perform their checks, and the textual clues in how they word their analyses aren't reliable. Neverthrless, it looks like Trustlook checks ROM version and scans mp4 files, while Michael Kohl's scanner checks build.prop values. McAfee's warnings imply that the checkers from Trustlook, Eset, and Zipernium actually contain code that looks like an exploit, even if it isn't identified as a stagefright exploit.
[Android Q&A, Help & Troubleshooting] voxluna:
Oh, I absolutely I agree. Your comment in its entirety just reinforces the fact that anything devised in this thread can't be tested to a reasonable certainty so far. That's why I eventually gave in and just upgraded to 5.1.1 with the patches, even though it's not a stock-based ROM (which turned out to be great, but I digress).

I suppose the takeaway is, no fix is certain without patching.