Android is the most popular mobile operating system on earth. About 80 percent of smartphones run on Android. And it turns out, there's a gaping hole in the software: a hole that would let hackers break into someone's phone and take over, just by knowing the phone's number. That's according to mobile security experts at the firm Zimperium.
Just A Text
In this attack, the target would not need to goof up — open an attachment or download a file that's corrupt. The malicious code would take over instantly, the moment you receive a text message.
"This happens even before the sound that you've received a message has even occurred," says Joshua Drake, security researcher with Zimperium and co-author of Android Hacker's Handbook. "That's what makes it so dangerous. [It] could be absolutely silent. You may not even see anything."
Here's how the attack would work: the Bad Guy creates a short video, hides the malware inside it, and texts it to your number. As soon as it's received by the phone, he says, "it does it's initial processing, which triggers the vulnerability."
The messaging app Hangouts instantly processes videos, to keep them ready in the phone's gallery. That way the user doesn't have to waste time looking. But, Drake says, this set up invites the malware right in.
If you're using the default messaging app, he explains, it's "a tiny bit less dangerous." You would have to view the text message before it processes the attachment. But to be clear, "it does not require in either case for the targeted user to have to play back the media at all."
Once the attackers get in, Drake says, they'd be able do anything. Copy data. Delete it. Take over your microphone and camera to monitor your every word and move. "It's really up to their imagination what they do once they get in."
There's A Solution, In Theory
According to Zimperium, this set of vulnerabilities affects just about every active Android phone in use. Drake says he discovered it in his lab, and he does not believe that hackers out in the wild are exploiting it. At least not yet.
In correspondence in April and May, he shared his findings with Google, which makes the Android operating system. He even sent along patches to fix the bugs.
He recalls, "Basically, within 48 hours I had an email telling me that they had accepted all of the patches I sent them. Which was great. You know, that's a very good feeling."
But it goes away very quickly, he says, when you look at how long it'll take his Nexus, my Samsung Galaxy, your LG or ZTE to get those patches. Drake says that as few as 20 percent will get fixed. Though the figure may be higher than that, he says, "potentially up to the optimistic number of 50 percent."
Android Partnerships Are Complicated
Just half of affected smartphones is not a very optimistic estimate. And Google agrees with it.
The company declined a recorded interview. But Adrian Ludwig, the lead engineer for Android Security, told NPR: the flaw ranks as "high" in their hierarchy of severity; and they've notified partners and already sent a fix to the smartphone makers who use Android.
Whether it gets put into people's phones is not in Google's hands.
Collin Mulliner, senior research scientist at Northeastern University, says, "In this case Google is not the actual one to blame. It's ultimately the manufacturer of your phone, in combination possibly with your carrier."
Android phones are very different from iPhones, for example. Apple runs a closed system. It controls the hardware and software and it's fairly easy to ship out a major revamp. The company says 85 percent of iPhone users have the latest operating system, iOS8.
According to security firm F-Secure, 99 percent of mobile malware threats in the first quarter of 2014 were designed to run on Android devices.
Google gives its latest version of Android to manufacturers, who then tweak it as they please. Carriers like Verizon and T-Mobile do more tweaking. The blog Android Central has described the challenge of updating the operating system as an "impossible problem." Earlier this year, a hole discovered in the web-browsing app was left largely unpatched too.
Often, Mulliner says, manufacturers don't have a financial incentive to fix phones already sold. "If you can save money by not producing updates, you're not going to do that," he says. "Since the market is moving that fast, it sometimes doesn't make sense for the manufacturer to provide an update."
NPR has asked leading phone makers and wireless service providers if they'll fix the bug. We're waiting for responses and will post them to this page.
Copyright 2015 NPR. To see more, visit http://www.npr.org/.
