(credit: Ron Amadeo)
It was a bad week for millions of Android phone users. Two critical vulnerabilities were disclosed but remain unpatched in a large percentage of devices, while, separately, malicious apps were downloaded as many as 2.5 million times from Google's official Play Marketplace.
The vulnerabilities, which are similar in severity to the Stagefright family of bugs disclosed last year, have been fixed in updates Google began distributing Tuesday. A large percentage of Android phones, however, aren't eligible to receive the fixes. Even those that do qualify don't receive them immediately (the patches are currently not available for either of the Nexus 5X devices in my household). That gives attackers crude blueprints for exploiting vulnerabilities that remain unpatched on millions of devices.
"Extremely serious bug"
The first vulnerability was disclosed by Mark Brand, a researcher with Google's Project Zero security team. Indexed as CVE 2016-3861, it allows attackers to execute malware or escalate local privileges on vulnerable phones. Brand warned that it's "an extremely serious bug" because it can be exploited in a large variety of ways. He also said CVE 2016-3861 wasn't particularly hard to detect, a finding that increases the chances that other researchers already knew about it. (In any event, Brand included exploit code with his disclosure.) Brand didn't say exactly which Android version introduced the code-execution vulnerability, but he indicated that it's present in at least several of the most recent releases.