yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] Phk:
Stay tuned.. Some devices have received OTA today :)
[Android Software/Hacking General [Developers Only]] edzamber:
No OTA for me, rooted and my own custom Rom based I9505HOF2...
[Android Software/Hacking General [Developers Only]] Camacha:
I hope you will excuse me for being a sceptic, but I would argue you cannot be careful enough :) How do we know for sure the build.prop edit mitigates the Stagefright vulnerability? The only proof seems to be an app of unknown origin from a not a very well known author. Can we even be sure without testing an actual attack?
[Android Software/Hacking General [Developers Only]] Miss Montage:
Jiayu Germany and [MENTION=4196889]DerTeufel1980[/MENTION] released a patch for their S3 and Kitkat. Huge Thanks!!!

Thanks to bigrammy! This patch should work on all MTK 6732/6752 devices running Kitkat 4.4.4. It can be installed in custom recovery.

PATCH UPDATE 15-08-2015 against CVE-2015-3864

Please run a full Nandroid Backup before installing the patch and backup the original /system/lib/libstagefright.so - e.g. you can rename it to libstagefright.so.bak
[Android Software/Hacking General [Developers Only]] Miss Montage:
[MENTION=3647350]Camacha[/MENTION] : you are right about being sceptic, but I trust the author of the app (Zimperium Stagefright Detector) to a certain degree, since it is the same group that detected the vulnerability. The fact that they went public almost simultaneously with Google announcing first patches does not speak against them, neither...
[Android Software/Hacking General [Developers Only]] Camacha:
Sure, but I am not sure how trusting them helps things. All the devices with the build.prop fix are still indicated as vulnerable. According to some people in the other thread, the build.prop fix does nothing to mitigate the issues, as would be proven by the app. I am not sure what to believe any more. I guess it depends on whether the app actually tests anything, or just attempts to detect the vulnerabilities themselves.

Edit: I overlooked your post about the patch. That seems to work all right. Sadly it does not help my device.
[Android Software/Hacking General [Developers Only]] edzamber:
I wonder if Stagefright fail can be use by hacker if NuPlayer is selected... According to this guide, Stagefright needs AwesomePlayer to works...

Does NuPlayer react differently ?

https://quandarypeak.com/2013/08/androids-stagefright-media-player-architecture/

Stagefright NuPlayer implementation

http://stackoverflow.com/questions/23724514/stagefright-nuplayer-implementations

http://stackoverflow.com/questions/23564376/stagefright-streaming-playback-architecture
[Android Software/Hacking General [Developers Only]] Phk:
Hey Camacha, I understand why or where is your confusion: The bug relies on LIB files for 4 different codecs. There is a player that uses those libs which is called Stagefright. That player is itself a system-lib that can be called by several middle-ware components, or apps, such as "messages" app for playing MMS files, or Firefox for playing embeded MP4.

The build.prop file disables the availability of the stagefright player and codec system-calls. This doesn't fix the problem at its heart, not stops an App for calling the vulnerable libs directly.

When you think of a vulnerability, you have always to think of attack vectors and for each vector, usage difficulty and probability (sometimes aka exposure).

In this case the most risky and probable vector is the MMS shown at Blackhat (aka 1). The most probable is the Firefox\custom app vector (2)

(1) is fixed by build.prop that I posted

(2) is only fixed when you either:

a. flash a patched lib for your ROM version (the other link that I posted for Samsung lollipop)

b. apply an OTA from your vendor that has this fixed (only very few devices have this already available)

c. flash a custom ROM that was built on a fixed vendor release (there must be some around, i saw one for S5, can't remember which one)

Does this help you understand?
[Android Software/Hacking General [Developers Only]] poodleDoo:
Updated build.prop, stagefright detector & stagefright viewer still says vulnerable

I added the following lines to my build.prop:

media.stagefright.enable-player=false
media.stagefright.enable-http=false
media.stagefright.enable-aac=false
media.stagefright.enable-qcp=false
media.stagefright.enable-fma2dp=false
media.stagefright.enable-scan=false
mmp.enable.3g2=true
mm.enable.smoothstreaming=true
media.aac_51_output_enabled=true
media.stagefright.enable-record=false
media.stagefright.enable-meta=false
media.stagefright.enable-rtsp=false
ro.hdmi.enable=true
lpa.decode=false
tunnel.decode=false
tunnel.audiovideo.decode=false
lpa.use-stagefright=false
qcom.hw.aac.encoder=true

Rebooted after the change...

I'm running 4.4.4 on a nexus 5...

Any ideas?

Thanks
[Android Software/Hacking General [Developers Only]] Camacha:
Ìt confirms what I already feared. Thanks for the explanation :) Does this mean adverts (in apps) can also call the vulnerable libraries directly, or do you really need an app for that? I ask because I am wondering how vulnerable the system still is: is an infected advert enough, or do you really need to download an app with a malicious payload? Only downloading trusted apps is reasonably doable, avoiding random adverts is almost impossible.

Can you tell us anything about your sources? :) I would love to read up.

Did you actually all add them, or did you replace some/most? Because if you add them instead of replacing them, chances are there also are original lines, so you might switch things off and then on again.

Besides, isn't there a patched update for the Nexus 5 available already? I would much prefer to update the phone, if at all possible.
[Android Software/Hacking General [Developers Only]] poodleDoo:
Thanks for your reply :good:

I added them at the end and confirmed the same props are not listed anywhere else in the file. Any ideas welcome.

By chance do you have the thread link for the N5 patch?

I'll search in the N5 forum...
[Android Software/Hacking General [Developers Only]] Camacha:
I suspect you might need to paste them in the right place with the right header, but that is just a hunch.

I think they call it a patch, but it is in fact a full update. They seem to be available here, though I urge you to double check yourself to make sure you do not update with junk or malware.
[Android Software/Hacking General [Developers Only]] Lim Wee Huat:
Tested. Confirmed working. Thanks for the share..
[Android Software/Hacking General [Developers Only]] Phk:
Camacha, that's not possible with Google Ad Words; the ad libs are from Google and not from the App itself. The only AD-related info the app has is to tell what is the developer ID and where to place the app, yadda yadda. Not actual code.
[Android Software/Hacking General [Developers Only]] Camacha:
That would be a pretty definitive solution: not only disabling Stagefright, but veritably removing it. I am most interested to see how that works out, it might be the best option for people left without updates.
[Android Software/Hacking General [Developers Only]] nefescalanadam:
News..

http://www.cyanogenmod.org/blog/more-stagefright
[Android Software/Hacking General [Developers Only]] lauterohre:
Would it be possible for Android vulnerable partitions to protect / freeze?

When restart everything would then be restored, the pests have no chance.

I can not find such an app.

For example, by Windows I use for freeze the C drive, the program Shadow Defender

Is there something for Android?
[Android Software/Hacking General [Developers Only]] edzamber:
Stagefright Fix for i9505 Lollipop Stock based Rom :)

http://xdaforums.com/showthread.php?p=62326930
[Android Software/Hacking General [Developers Only]] Phk:
Whats the difference from previous Samsung patch? I've patched the previous version and its fine.
[Android Software/Hacking General [Developers Only]] edzamber:
Difference is that its i9505 Stagefright Libs from new OG1 Chilly's Rom
[Android Software/Hacking General [Developers Only]] Charlie R.:
A few points...

I don't know where the "3GPP" flaws might lie, so removing mp4, h.264 and webm might not be enough.

I'd like to remove all of these libraries, but I am hesitant to do so as I don't have a spare device.

Cyanogenmod cm11 does not have any of the build.prop/getprop entries for stagefright, although the libraries exist.

I created the directory /system/lib/bad, moved the video codecs to this new location, then rebooted. This does not impact the scanner.
[Android Software/Hacking General [Developers Only]] Phk:
CM has fixes the libs. Its actually safer to patch CM12 nightly today :)
[Android Software/Hacking General [Developers Only]] yanowman:
Maybe im an idiot...need help

This is a zip file, but when flashed in recovery it fails....

Anyone have clear instructions as to how to patch on all devices?
[Android Software/Hacking General [Developers Only]] Phk:
my file is not to be flashed. Its a diff file patch.

shell, su, cd /system, patch < file.patch

or just edit /system/build.prop and change to "false" everything that has "stage" on it :)
[Android Software/Hacking General [Developers Only]] :
Sprint HTC One M8 just got a patch update. Wonder if any of those guys can share what was updated.
[Android Software/Hacking General [Developers Only]] blumenkasten:
Do you have a version for MTK 6595?
[Android Software/Hacking General [Developers Only]] edzamber:
Damn !!!

New Stagefright Detector Update, New Stagefright vulnerability...

http://xdaforums.com/showthread.php?p=62332530
[Android Software/Hacking General [Developers Only]] Miss Montage:
No, im sorry....
[Android Software/Hacking General [Developers Only]] Phk:
Calm down, the new research team (Exodus) that has discovered the new way to exploit one of the overflows, has also explained things quite well.

I've did some research and actually Google has said something that, for me, changes the game...

I don't know if you are aware of the difficulty of building an actual exploit for this, but after you have the code that triggers the overflow, you need a proper payload specific for the target OS, which jumps to the offset of the system call you need to be executed with the stack you just built after the overflow. To simplify things: if ASLR is really on 90% of the devices, this vuln is actually very very difficult to be exploited, and has nothing to do with the "propaganda" of the original Zimperium talk... I mean, instead of publicizing this has affecting all Androids, Zimperium should have probably explained that this covers devices that do not randomize the location of system libs in memory. "From 100% to 10% target scope" .. lol

Until I see the actual code contents for the infamous "exploit-mms.py" file shown in the Demo, personally, I'm turning off my alarm for this vuln :)
[Android Software/Hacking General [Developers Only]] Miss Montage:
Thanks for the reassurance [MENTION=1480096]Phk[/MENTION] ! However, I interprete the Google quotation slightly different: 90 percent of the devices are far harder to attack, but not "secure". Can anyone tell me if identifier CVE-2015-3864 is still a threat when all vectors are alright and autofetch MMS is disabled? In other words: Does it affect MMS or embedded videos or both? I don't use Google Messenger, Hangouts, What's App or any other messenger....
[Android Software/Hacking General [Developers Only]] Phk:
Hi, two things:

Yes, what google says means they are not safe, but exploiting the vuln to things other that causing a FC is very very very difficult. System calls are on random RAM locations so the exploit had to had a "hard guess" on what (void *)() destination to call hehehe :)

About the new CVE; afaik is more of the same. Just disable things in build.prop has I mentioned and you're good to go. In a few months you will update your ROM and vendor libs are fixed :D
[Android Software/Hacking General [Developers Only]] Miss Montage:
Hehe, just had to wait a couple of hours :) Thanks again so much [MENTION=4196889]DerTeufel1980[/MENTION] and Jiayu.de

The patch works on my UMI Hammer and should work on all MTK 6732/6752 devices - no modifications required...
[Android Software/Hacking General [Developers Only]] Phk:
Share the files with us :)
[Android Software/Hacking General [Developers Only]] Miss Montage:
Done...
[Android Software/Hacking General [Developers Only]] Phk:
Checkem [MENTION=5882238]ocd_amp[/MENTION]
[Android Software/Hacking General [Developers Only]] Miss Montage:
[MENTION=5802237]Desmanto[/MENTION] : There you go:
[Android Software/Hacking General [Developers Only]] Desmanto:
Thanks. After loaded it up in ultracompare, there are 700+ Kb differences. Seems no chance of porting it to another android, unless we can extract the .so and check for difference inside.
[Android Software/Hacking General [Developers Only]] Miss Montage:
Yes, I am very lucky that I simply could take the file it as it is. I don't have a clue about code, never used a compiler... :p

I have seen [MENTION=4507636]edzamber[/MENTION] 's patch for Samsung, it contains far more libstagefright files...

But any interested developers might contact jiayu.de or [MENTION=4196889]DerTeufel1980[/MENTION]
[Android Software/Hacking General [Developers Only]] Desmanto:
Actually for the last 3 days, I have been researching about this bug and trying to gather up all the information in a single thread in our local forum. Visiting a lot of website, from zimperium, trendmicro, hackernews etc. And so far, haven't seen any actual real exploit directly, besides the demo video from zimperium. Seems like the forge the demo phone so it is easier to be hacked. The ones from trend micro simply showing mediaserver crash, not executing any remote code. It seems the security companies are taking this opportunity to scare people out of mind. You know what is the real purpose.

Maybe we will be more alerted or impressed, if someone just take out a clean phone, stagefright bug vulnerable, with just a few not so important picture in it. Then he proceed to give zimperium his phone number and challenge them to hack his phone and retrieve the pictures. If they success, then proceed on testing with the MMS auto download disabled, build.prop stagefright disabled, then along with another suggested temporary fix until google patch it properly.

For additional information, I just found out the suggestion from the comment on another site, that one of the way is to delete all MMS access point, so the MMS will never be received anymore. (BTW, who still use MMS again nowadays?)
[Android Software/Hacking General [Developers Only]] Miss Montage:
I'm quite certain that it's not easy at all to attack a modern smartphone. As [MENTION=1480096]Phk[/MENTION] wrote, for a phone that supports ASLR it should be nearly impossible - as far as I know, that is for all phones with Android 4.1 and later. I haven't read about a real attack neither. Only one member in one of my local forums is wondering about an MMS alert without finding an MMS in his apps. He had activated automatic download. I read somewhere that an attacker could even delete the manipulated MMS.
[Android Software/Hacking General [Developers Only]] Charlie R.:
Going through the source patches, they references only 3 files:

MPEG4Extractor.cpp

SampleTable.cpp

ESDS.cpp

A complete (?) collection of the Stagefright source code can be found here:

https://android.googlesource.com/platform/frameworks/av/+/master/media/libstagefright/

Most of the patches focus on the MPEG4 code. The question is if the flaws from SampleTable and ESDS are in separate libraries, and if those libraries are exploitable.

Usually, a Makefile would tell the story of what source code is compiled into which objects. There must be some other way of discerning this.

As far as an exploit, the question is not if Zimperium has done it, but if more specialized blackhat teams have done it. This may include nation state security services, firms like the "Hacking Team" that were outed recently, or some guy in a garage somewhere. If it is possible to do it, then the exploit code is likely lurking on classified servers in several nations.
[Android Software/Hacking General [Developers Only]] Phk:
I'm NOT worried about who how or when can it be exploited; I'm focusing on disabling it (build.prop) and flashing patched libs as soon as they're ready for my device :)
[Android Software/Hacking General [Developers Only]] jossilint:
is there anyone who has .so patches for slimkat 4.4.4 lastest stable that was released end of 2014? i would like to stay on 4.4.4 until real dark slim option comes. i9505
[Android Software/Hacking General [Developers Only]] Desmanto:
Yes, it is possible to delete the traces after the attack finished. The question might be, if the atttacker successfully bypass ASLR (by any means), he still gain access as media user. Which mean in order to get full access, he still needs to root the phone, installing the su binary and so on. Does this mean it will be easier to use the exploit at the rooted phone? Non root user will have extra protection from the additional rooting process (which i don't how far it mitigate the exploit).

Then after successful hack, the phone still need internet connection or some sort of the sms/mms to sent the code response to the hacker. I have an old GB 2.3.6 phone, which will never be updated anymore. I just recently planned to use it as local file/media server. There is no sim card in this phone anymore, as I don't use it for a long time. Will it be completely secure if I just connect it to wifi, but don't set the gateway and DNS, so the phone still can be accessed via local wifi, but not from outside? Even after the phone is compromised, there is no way to sent the response back to the attacker.

Yeah, that will be the scary part. As if the exploit is public already, then usually there were already several blackhat teams using it in the past prior the publication. From the CVE, all stated it is the mp4 dan 3gpp part that has this bug. So, all effort will be more directed towards there.
[Android Software/Hacking General [Developers Only]] Charlie R.:
Nightmare scenario

I used the "ghettoroot" package to wipe Samsung stock off my phone. I was able to call "./ghettoroot /system/bin/mksh" and get a root shell, which rebooted the phone immediately after exit (I can post the session if you're curious). Towelroot is likely very similar, although I have never used it from the shell. The point here is that you don't need an su binary, or the whole SuperSU .ZIP - you just need the exploit binary, which is not very big. Any app that you load from the Play store could bundle this, and take root on all Honeycomb - Jellybean, and a sizable segment of KitKat.

A vicious stagefright worm would bring along a towelroot, take over root on the phone on arrival if possible, then send itself to everyone in the phone's address book. If/when it had network access, it would use a torrent/dht-like client for command and control rather than hardcoded IPs. The C&C node could command the client to upload cached sqllite databases, passwords, etc., or receive new scripts to run as root on the infected botnet. That would be Android's nightmare scenario, and everyone who was infected would have to buy a new phone.

Searching "MMS Stagefright" in the Play store, the top messaging app hit is Textra SMS. They guarantee that they are not using stagefright libraries for media processing.

I'm going to check the FDroid repositories for SMS apps tonight. I'd prefer something open source.

...checked FDroid - it has the SMSSecure replacement app, which is a fork of TextSecure. The reviews on Google Play have a discussion where the app developer states the following in several threads:

"From what is known about stagefright at the moment SMSSecure is not vulnerable to the auto-exploit. You would have to download and view the MMS manually for your device to compromised. [sic]"

"Q: My MMS messages load automatically as long as my data is on. How do I prevent this? A: There is no pre-processing that involves stagefright. The user has to tap on the MMS and confirm a warning about playing media insecurely before stagefright is invoked and the exploit could be triggered."

http://smssecure.org
[Android Software/Hacking General [Developers Only]] Desmanto:
Reading ur post makes me feel stagefright bug is nothing compared to above. Without using stagefright bug itself, one could also bring any malware and provide the similiar kind of the infection. This bug only open a new vector of attack which require zero interaction from the user, which can be easily blocked. The other vector of attack is similiar to above. Seems we need to have more careful inspection of which developer (or source of the apk) we choose to install from.
[Android Software/Hacking General [Developers Only]] chrcol:
Here is my thoughts.

1 - the detector apps are poor, they seem to just check the version of existing libs to determine if vulnerable rather than testing the exploit. So e.g. they will still say vulnerable if stagefright has been disabled.

2 - kitkat samsung patched libs seem non existant, I tried the one posted in this thread from the german S3 on my s5 g901f running kitkat but the device wouldnt boot. Given my phone has a lollipop rom I know samsung wont patch it on 4.4. but I dont want to use lollipop.

3 - for now I have disabled auto mms, my chompsms has some kind of protection also, and I applied buildprop fixes. But personally not am satisfied as I still have the vuln files in place.
[Android Software/Hacking General [Developers Only]] kato7youknow:
thank you for this fix

Thank you for this fix. :)

---------- Post added at 02:24 AM ---------- Previous post was at 01:42 AM ----------

What is the path in system so I can patch my O.S. path way? Help.
[Android Software/Hacking General [Developers Only]] Phk:
Hi Kato, thanks. Just use root explorer and set everything in /system/build.prop to "disabled" in every line that has the word "stagefright" in it :)
[Android Software/Hacking General [Developers Only]] Camacha:
I noticed that some antivirus software now detects offending Stagefright code in apps. When Stagefright Detector got updated, all alarm bells went off :D Together with the buildprop edits in this thread and the proper MMS settings, the risk should be controllable pretty well, since the only remaining way to abuse the vulnerability is through apps that address the library directly. Even if you get giddy and download all the wrong apps, you should get a warning before it is too late.

Do not take my word for it, though, I might be mistaken. Also, updating to a non vulnerable version of Android is the wise thing to do.
[Android Software/Hacking General [Developers Only]] Phk:
Make sure to add the "=false" lines in the correct place:

#persist.cne.feature=1

#system props for the MM modules
media.stagefright.enable-player=false
media.stagefright.enable-http=false
media.stagefright.enable-aac=false
media.stagefright.enable-qcp=false
media.stagefright.enable-fma2dp=false
media.stagefright.enable-scan=false
mmp.enable.3g2=true
mm.enable.smoothstreaming=true
media.aac_51_output_enabled=true
[Android Software/Hacking General [Developers Only]] unclescary:
How to install patch

Sorry. I am a slow but capable person. How do I install patch? I did follow the instructions and modify the build.prop file. So I assume Im safe but still think unrooting and installing a patched L710VPUDOH1 would be ok. All information is greatly appreciated.

Im looking for L710VPUDOH1 md5 file. Thought this would be easier to just unroot and reroot with it.

Thank you very much for your help and time. Mike
[Android Software/Hacking General [Developers Only]] kato7youknow:
thank you. @ Phk

Thank you for your work. Great build.prop patch.
[Android Software/Hacking General [Developers Only]] Phk:
Delete the characters in RED :)
[Android Software/Hacking General [Developers Only]] kato7youknow:
reply

OK thanks.