New patch required for an old vulnerability in Android phones

New research issued by Israeli-based NorthBit finds that millions of android phones are at risk due to an old vulnerability that was understood to have been addressed.

Millions of Android phones might be vulnerable to attacks that previously were thought to be fixed, according to a new research paper by Israeli company Northbit. Android users could have their data and information accessed by hackers if they visit certain sites. UPI/Terry Schmitt | License Photo

HERZLIYA, Israel, March 21 (UPI) -- Millions of Android phones are at risk due to an old vulnerability that was thought to be fixed. Israeli-based NorthBit has released a new research paper explaining a new way to exploit a weakness found in Stagefright, Android's media server and multimedia library. Advertisement

If a user accessed a malicious website, the vulnerability could allow hackers to have access to data and functions on a various versions of Android.

Hackers could effectively attack devices running Android versions 2.2 through 4.0, 5.0 and 5.1, NorthBit said. The company has named its new exploit "Metaphor."

The new attack is the most effective on Google's Nexus 5 with stock ROM. It also works, with some modifications, on HTC's One, LG's G3 and Samsung's S5, the company said.

Google has patched the vulnerability twice before, after security company Zimperium found the original Stagefright flaws in early 2015.

The exploit has two weaknesses, Northbit found.

It has to use a different code for each type of phone in order to hijack it, thus hackers would have to create multiple versions of "Metaphor" to utilize it on a massive scale. Secondly, the latest version of Android, 6.0 Marshmallow, blocks "Metaphor." Google's more recent October patch can block it on some older installs as well.

Advertisement