Why Metaphor Android phone hack isn't the Stagefright exploit you expect

Metaphor relies on poor Android patches, but users can still fend off attacks

If you're an Android owner, you have probably already heard of Metaphor - a scary-sounding exploit for the Stagefright flaw found in Google's mobile operating system last year.

The media is hyping Metaphor, discovered by researchers at Israeli security firm NorthBit, as the first reliable exploit of Stagefright, which was judged by some to be too difficult to take advantage of.

Advertisement - Article continues below

Stagefright is a media library within Android that allows the operating system to interpret various media, namely video files, audio files, and picture files.

The Stagefright bug, and later version of it, exploits integer overflow vulnerabilities in the Stagefright software library, which can allow an attacker to hijack a device.

How Metaphor works, and why it's dangerous

Unlike previous Stagefright exploits, Metaphor relies on JavaScript, rather than MMS, so users would need to be coaxed into visiting a compromised or malicious site and remaining there for some time while the attack took place.

So far, so scary. But what a lot of the reporting of this new Stagefright bug overlooks is the reason why so many Android devices are still vulnerable to this type of attack.

The problem with protecting against Metaphor, and against all Android vulnerabilities, is more to do with the way that Android is distributed than anything else. Namely, because Android is adapted and reskinned by each vendor, the roll out of new OS versions across all Android devices is painfully slow.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

So, while Android Marshmallow and Lollipop both come with Stagefright patches in place, that's cold comfort to the 62 per cent of users whose phones do not run either of those operating systems.

These users are left vulnerable to attack simply because their devices do not yet support the latest operating system, even if it is relatively new.

How to beat Metaphor

However, users are not completely helpless in the face of Metaphor - not clicking on strange or unexpected links, stopping pages that try to redirect you, or exiting a page if it seems to be doing something strange could help thwart an attack, as it requires users to stay on the malicious page for up to two minutes in some cases.

But ultimately, it is up to the Android ecosystem to work out how to roll out updates faster, because leaving users as sitting ducks is not only unsafe, it's also unfair.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement

Recommended

Visit/security/355013/10-quick-tips-to-identifying-phishing-emails
Security

10 quick tips to identifying phishing emails

16 Mar 2020
Visit/business-strategy/mergers-and-acquisitions/354941/panda-security-to-be-acquired-by-watchguard
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/mobile/mobile-phones/355088/apple-lifts-iphone-purchase-restrictions
Mobile Phones

Apple lifts iPhone purchase restrictions

23 Mar 2020
Visit/infrastructure/server-storage/355118/hpe-warns-of-critical-bug-that-destroys-ssds-after-40000-hours
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020
Visit/operating-systems/microsoft-windows/355105/microsoft-puts-windows-development-on-lockdown
Microsoft Windows

Microsoft puts Windows development on lockdown

25 Mar 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

25 Mar 2020