Stagefright: Scary Code in the Heart of Android

by Joshua Drake

With over a billion activated devices, Android holds strong as the market leading smartphone operating system. Underneath the hood, it is primarily built on the tens of gigabytes of source code from the Android Open Source Project (AOSP). Thoroughly reviewing a code base of this size is arduous at best - arguably impossible. Several approaches exist to combat this problem. One such approach is identifying and focusing on a particularly dangerous area of code.

This presentation centers around the speaker's experience researching a particularly scary area of Android, the Stagefright multimedia framework. By limiting his focus to a relatively small area of code that's critically exposed on 95% of devices, Joshua discovered a multitude of implementation issues with impacts ranging from unassisted remote code execution down to simple denial of service. Apart from a full explanation of these vulnerabilities, this presentation also discusses; techniques used for discovery, Android OS internals, and the disclosure process. Finally, proof-of-concept code will be demonstrated.

After attending this presentation, you will understand how to discover vulnerabilities in Android more effectively. Joshua will show you why this particular code is so scary, what has been done to help improve the overall security of the Android operating system, and what challenges lie ahead.

[Ronnie]

I'm getting nervous of this guy dancing behind the desk, prolly affected with Stagefright

[gcv]

The stagefright bug came back again. My phone and tablet was patched up and secure from stagefright after I was sent an update, but now it's vulnerable again. Android need to regularly send patches to phones all around the world in order to combat this bug. Perhaps until then, we should use our smartphones and tablet like dumb phones ie turn off mobile network and wifi and only use for calls and sms messages I wonder if that would help??

[TheRainstorm]

how or where can I learn more about all this?  college classes??  is this information technology?  someone please help... I want to know what I am doing with my home computers and my cell phones,   both have crashed and I cant keep dealing with this blindly.  what can I do to learn more????

[TheRainstorm]

oh my.  all of this is beyond my level of comprehension...I updated my lg volt for this "stage fright" and now its stuck rebooting itself over and over...it's been almost a half hour... can anyone tell me what to do...is my cell broken or is this part of the update?  and can anyone explain this in terms that someone like me can understand?  and I really don't know much even after watching this video....

[pruittboy]

Samsung finally started cranking out the patch late last month.

[hightech]

iOS has it's own issues. It was and still is affected by ShellShock

[tmmy]

I wonder when Android will finally copy iOS's most important feature, security