The Stagefright Bug, and Your App
By now, it is fairly likely that you have heard about
the Stagefright security vulnerability
existing in most current versions of Android.
There is not much that developers can do to help prevent their apps
from being the means for malware to exploit this bug. The only absolute
way to prevent an app from causing this problem is to not play any
multimedia obtained from arbitrary sources through Stagefright,
and that restriction is
impractical for many apps.
In theory, one could attempt to devise some sort of scanner that
looks for the sorts of media content that would signal an attempt to
exploit Stagefright. However, creating such a scanner is likely to be
rather difficult, and it implies that you are in position to scan
all media ahead of time. For apps reliant upon streams, that alone
may be a show-stopper.
Until we understand more about the types of media and forms of playback
that could trigger this vulnerability, it is unclear if switching to
a different playback engine (e.g., ExoPlayer)
will help mitigate the risk or not. Hopefully, we will learn more after
the presentations on this vulnerability
scheduled for Black Hat USA and DEF CON 23 in August.
If your app automatically plays media obtained from outside sources,
consider disabling that, so users at least have to specifically request
the media playback. In effect, this is what the ���prevent MMS messages from
automatically loading��� guidance is suggesting to users. Fortunately,
many SMS clients have the ability for users to toggle off MMS auto-playback.
If your app has a similar auto-play capability, if nothing else, provide
an equivalent setting where the user can disable the auto-play feature.
Where this is really going to be a problem is with ads.
If your ad network might be sending down something other than plain images
or simple HTML, such as audio or video, see if you can disable that
type of ad. If that is not possible, contact your ad network and ask them
when they will integrate this sort of control, or what else the ad network
is doing to ensure that the ad network is not taking on ads that might
trigger the Stagefright vulnerability.
In the meantime, we need to wait patiently for somebody to provide us a
bit more to go on with respect to the scope of the vulnerability, so that
we can perhaps come up with more specific guidance for developers.
