Google Hangouts

Android phones and the StageFright vulnerability

 

An issue was recently discovered on Android devices which could expose the user to potential cyberattacks. It is characterized by a specially crafted text message which attaches multimedia (video, music, pictures) data to the communication. By default, Android tries to process this information in the background so that when you open it up, it doesn’t buffer or cause delays with seeing the content. When the android device is attacked, malicious StageFright imagecommands are sent to the phone in the background and the user do not know they have lost control of the device. Risks of a compromise include stolen passwords, leaked contact information which are subject to attacks, data loss if files are stored on the device, and potential fraudulent transactions conducted in the user’s name without their knowledge or consent.

Unfortunately, fixes for android devices are pushed infrequently, but there are some steps you can take to prevent yourself from becoming a victim of this type of attack until your manufacturer releases an update.

There is an option in the text messaging application used to disable the automatic retrieval of MMS (multimedia) text messages. This allows you to determine if you trust the sender of the message before opening their communication. The steps for disabling may be slightly different for various versions of the Android operating system, but typically the user can find it by following these instructions.

Google Hangouts as default SMS:

  • Open Google Hangouts
  •  Choose Settings
  •  Select SMS
  •  Scroll down and turn off Auto Retrieve MMS

Google Messenger as default SMS:

  •  Open Messenger App
  •  Go to right hand of application and select the three dots
  •  Choose Settings
  •  Choose Advanced
  •  Turn off Auto-retrieve

Other (using default messaging app):

  •  Go to Messages App
  •  Select More
  •  Select Settings
  •  Select Multimedia Messages
  •  Turn OFF Auto retrieve

In order to see multimedia messages in the future, users will be required to click on the download button and the phone will process them as usual.

We are recommending that users watch closely for an update from the manufacturer that addresses this issue and apply it as soon as it is released. For additional information on the StageFright vulnerability, please visit the website: http://fortune.com/2015/07/28/stagefright-google-android-security/

For assistance, contact the Solutions Centre at 403-329-2490, or help@uleth.ca, or visit E610 in University Hall.