The compromised device is connected back to server, dumping all properties of the device. The victim opens a link that leads to cat photos, while NorthBit shows the real time attacking scenario. The video shows a victim using Nexus 5 running on Android 5.0.1 operating system. As shown in Stagefright: Mission Accomplished, the exploit uses integer overflow issues to cause more bytes to be read into an buffer than were allocated for the buffer. NorthBit has also uploaded a video of a successful attack. Answer: The most recent one and at least some of the original bug work through a heap overflow exploit. “Looking at these numbers, it’s hard to comprehend how many devices are potentially vulnerable,” NorthBit wrote. &0183 &32 StageFright is an issue with how Android implemented the 3GPP decoder, which is buried deep in the compiled OS code. 4.0% of Android versions are versions 2.x with no ASLR about 40,000,000 devices.They even shared the distribution of Android platform versions taken from statista, which depicted – The team built a working exploit affecting Android versions 2.2 – 4.0 and 5.0 – 5.1, while bypassing ASLR on versions 5.0 – 5.1 (as Android versions 2.2 – 4.0 do not implement ASLR). It was also tested on HTC One, LG G3 and Samsung S5, however exploitation is slightly different between different vendors. The company also said that the exploit works best on Nexus 5 with stock ROM. They present a more thorough research of libstagefright and new techniques used to bypass ASLR. The paper presents the research results, further details the vulnerability’s limitations and depicts a way to bypass ASLR as well as future research suggestions. What’s the Official Fix and When Is It Coming According to Joshua Drake from Zimperium Labs, he already sent the patches to Google in June to avoid Android Stagefright security flaw, which they have. The research company NorthBit, based in Israel, published a paper ‘ Metaphor‘ – that’s the name of their stagefright implementation. The vulnerability or exploit in an inherent part of Google’s Stagefright (media playback engine), which was introduced in Android 2.2. Metaphor – A (real) real life Stagefright exploit

What is stagefright vulnerability