AnotherAndroid Bug That Lets Hackers Control Your Phone With One Text

Just when the worldwas starting to cool down out about Stagefright , some Israeli hackers harbinger more defective news . Just like Stagefright , there ’s another Android vulnerabilitythat lets hackers take control of a phonewith a single schoolbook . What ’s worse is that there ’s not an well-heeled fix .

Announced today at the Black Hat security league in Las Vegas , it ’s called Certifi - gate . The inquiry team from Check Point that found the exposure explained the detail to a half confused audience in Las Vegas on Thursday morn . I say half - confuse because the session ’s deed — “ Front Door Access to Pwning Million of Androids ” — sound so familiar tothe Stagefright panic attack that captured headlines at the end of July . However , the Check Point team ’s determination bring out a more complicated issue with Android security department that go around around how the lock organisation fails to verify apps with privileged permissions . This means that it ’s easy for a hacker to take over almost any Android earphone with a fake app or even an SMS .

The apps in question are know as mobile removed support tools ( mSRTs ) . These often add up pre - installed by the manufacturer or carrier and enable keep teams to access and restraint devices remotely , mainly for fixing trouble . You might not know it , but you believably have an mSRT installed on your Android headphone . It likely does n’t even have an ikon in your catapult . Google does n’t ship these apps with stock Android , and there ’s no aboriginal way to swan certificate , even though they ’re often grant inner permit like the ability to install new apps , reach the screen , or mimic user input .

Spacex Starship Separation

Long story short , the Check Point team figured out a fairly straightforward way to create faux credential and gain full access to an Android gadget with an mSRT install . In the Black Hat demo , Check Point ’s Ohad Bobrov and Avi Bashan demonstrated two way of profit memory access . One require installed a fake torch app that request very few permit but really give them full control over the machine thanks to the vulnerability . The other involved charge a single text message that could squeeze the remote access tool to issue any command . The hack is somewhat scary - looking in action .

It ’s not all big news . The Check Point squad reported the exposure to Google as well as a number of gimmick producer ( LG , Samsung , HTC , Huawei , etc . ) as well as carriers . Many of them have already addressed it , but the researchers warned that there are still million of devices that could still be vulnerable . Handily enough , Check Point built a scanner app that youcan download from the Google Play Storeto see if your earphone is one of them .

All that said , two handsome Android vulnerabilities in as many week serves as more grounds that the province of Android security department seems doomed . When so many dissimilar thespian are contributing to the development of the open seed operating system , there are ineluctably just as many opportunities to overlook thing . And when speculative vulnerability are find , Google ca n’t always resign a package update and fix everything at once . Apple devices do n’t quite have that problem , but they can be hacked , too .

Lilo And Stitch 2025