Android Police

stagefright

Readers like you help support Android Police. When you make a purchase using links on our site, we may earn an affiliate commission. Read More.

latest

You may have heard of Mr. Robot, an award-winning show about a clinically-depressed cybersecurity engineer hired by "Mr. Robot" to join a group of hacktivists. The latest episode, "eps2.6_succ3ss0r.p12," opens with a discussion between a Nexus owner (Mobley) and an iPhone owner (Trenton). Take a look at the clip:

People are upset at phone manufacturers for taking their sweet time sending out software updates. That's understandable. It's why commenters laughed at Sony for releasing Android 5.1 to some of its phones several months after Marshmallow was available. It's why customers are pissed that Motorola isn't standing by some of its cheaper handsets. And apparently it's why a consumer advocacy group is suing Samsung in the Netherlands.

As he tends to do, HTC VP Mo Versi has Tweeted details of a pending update for the M9. This time it's the Verizon version of the device, and it's getting Android 5.1 tomorrow. But it's more than just Android 5.1. This OTA also adds some LTE bands for roaming and patches Stagefright too.

Samsung isn't leaving its flagship of yesteryear completely high and dry in this age of Stagefright vulnerability. An update is being sent to the Verizon Galaxy S4 today that patches the Stagefright vulnerability, and adds a few more fixes for good measure.

Last week, Google released factory images for every actively-supported Nexus except the Nexus 7 2013 LTE and Nexus Player. These images were for a new build, LMY48I, intended to patch the recently outed vulnerability that was found in Stagefright.

Google announced the Stagefright vulnerability fix would start rolling out as an OTA today, but it has also added new factory images to the Nexus developer pages. That means bootloader unlocked Nexus phones and tablets can flash the new build immediately, even if your device is running some wacky ROM.

Google and the various major Android device vendors and carriers are scrambling to patch the recently-discovered Stagefright exploit, a weakness in Android's multimedia processing that can allow remote access via a simple MMS message. Google has already begun patching Nexus devices, and Samsung is working its way through its extensive product range starting with flagships. Yesterday Motorola released its plans to update its phones.

Google is rolling out the Stagefright patch to Nexus devices as promised, but the bigger news alongside that announcement is a new update policy for Nexus devices. Going forward Google will release security patches for Nexus phones and tablets about once per month, which mirrors Samsung's recently announced Galaxy update program. Google is also making official the length of time you can expect to get Nexus updates.

We knew that Stagefright fixes were due to start rolling out this week, and it's Sprint leading the pack. Sprint already rolled out an update to the Note 4 earlier this week, but now you can add several more Samsung devices to the list, plus the carrier has confirmed LMY48I for Nexus devices will have the Stagefright fixes included.

The Samsung Galaxy Note 4 is getting an OTA update today, and it takes the device from 5.0 up to 5.1.1. That means a few small tweaks to the system, but there are also some important bug fixes, including one for the Stagefright vulnerability.

So you might have heard about the Stagefright vulnerability that was published yesterday. While there's no evidence of a widely-used hack, the potential for malicious MMS attacks via Android's built-in media handling system (which could theoretically affect the majority of Android devices currently in operation) is certainly cause for concern. As reported on our original post, Google has known about the vulnerability since April and has been working on patches to fix the problem.

In a blog post published today by the researchers at Zimperium Mobile Security, the group divulged an extremely widespread security vulnerability that can be exploited with nothing more than a targeted MMS message. The hole exists in the part of the Android operating system called Stagefright, which handles the processing of certain types of multimedia.