Thursday, August 13, 2015

Android StageFright patches are out - here's how to update

The "StageFright" vulnerabilities could allow someone to take control of your Android device merely by sending a multimedia message. Here is how to check for and apply updates.

A couple of weeks ago, an Austin researcher spoke at the security conference Blackhat on flaws he had found in Android software. Commonly called "StageFright," the flaws could allow a malicious hacker to take control of a phone or tablet by simply sending a specially crafted multimedia message. The device would automatically download the message and have it ready for you to view, thus compromising the device without you having to even view the message.

At the time, there was no fix available, so I wrote a description of how to minimize the risk by disabling auto-retrieve for multimedia messages. Various phone makers and cellular carriers are beginning to roll out an update to fix* the flaw. Following are step-by-step instructions for checking to see if an update is available for your phone. I demonstrated the update using a Samsung Galaxy S5 running Android 5.1 (aka "Lollipop"); the screens and menus for other phones and versions will differ somewhat but the menu selections should be essentially the same.

*Research firm ExodusIntel found that the initial fix is not a complete patch and can still be exploited, albeit with a slightly different payload. Still, better to be partially protected than fully unprotected.


Checking for available updates on Android



Android notifications panel

Step 1: Swipe down from the top and find the "gear" icon to open the Settings menu.



Android settings menu

Step 2: Click the "System updates" option at the bottom of the Settings menu.



Check for new system update

Step 3: On the System updated popup screen, click "Check for new system update"



Checking for system updates...

Step 4: Your device will check to see if an update is available.



Software update ready to install

Step 5: If an update is available, your device will download the new update, and when ready show a screen saying "Software update ready to install." You can choose to install now, or can schedule the update to occur at a later time (for example, while you are asleep).



Software update complete

Step 6: After the update completes, you will see a screen saying the software update is complete.




Your Android device is up to date. No update is necessary at this time.

If no updates are currently available - or if you have already installed the latest update, you will see this message after selecting "check for new system update."

Do you have something to add? A question you'd like answered? Think I'm out of my mind? Join the conversation below, reach out by email at david (at) securityforrealpeople.com, or hit me up on Twitter at @dnlongen

Whois David?

My photo

I have spent the better part of two decades in information technology and security, with roots in application developer support, system administration, and network security. My specialty is cyber threat intelligence - software vulnerabilities and patching, malware, social networking risks, etc. In particular, I strive to write about complex cyber topics in a way that can be understood by those outside the infosec industry.

Why do I do this? A common comment I get from friends and family is that complex security topics give them headaches. They want to know in simple terms how to stay safe in a connected world. Folks like me and my peers have chosen to make a profession out of hacking and defending. I've been doing this for the better part of two decades, and so have a high degree of knowledge in the field. Others have chosen different paths - paths where I would be lost. This is my effort to share my knowledge with those that are experts in something else.

When not in front of a digital screen, I spend my time raising five rambunctious teens and pre-teens - including two sets of twins. Our family enjoys archery, raising show and meat rabbits, and simply enjoying life in the Texas hill country.

For a decade I served as either Commander or a division leader for the Awana Club in Dripping Springs, Texas; while I have retired from that role I continue to have a passion for children's ministry. At the moment I teach 1st through 3rd grade Sunday School. Follow FBC Dripping Springs Kids to see what is going on in our children's ministries.