How hackers can control Android phones via text message

Cyber security firm Zimperium on Monday warned of a flaw in the world's most popular smartphone operating system that lets hackers take control with a text message.

"Attackers only need your mobile number, using which they can remotely execute code via a specially crafted media file delivered via MMS (text message)," Zimperium Mobile Security said in a blog post.

"A fully weaponized successful attack could even delete the message before you see it. You will only see the notification."

Android code dubbed "Stagefright" was at the heart of the problem, according to Zimperium.

Stagefright automatically pre-loads video snippets attached to text messages to spare recipients from the annoyance of waiting to view clips.

Hackers can hide malicious code in video files and it will be unleashed even if the smartphone user never opens it or reads the message, according to research by Zimperium's Joshua Drake.

"The targets for this kind of attack can be anyone," the cyber security firm said, referring to Stagefright as the worst Android flaw discovered to date.

"These vulnerabilities are extremely dangerous because they do not require that the victim take any action to be exploited."

Malicious code executed by hackers could take control of smartphones and plunder contents without owners knowing.

Stagefright imperils some 95 percent, or an estimated 950 million, of Android phones, according to the security firm.

Zimperium said that it reported the problem to Google and provided the California Internet firm with patches to prevent breaches.

"Google acted promptly and applied the patches to internal code branches within 48 hours, but unfortunately that's only the beginning of what will be a very lengthy process of update deployment," Zimperium said.

It did not appear as though hackers had taken advantage of the Stagefright vulnerability, according to Zimperium.

Updating Android software powering mobile devices is controlled by hardware makers and sometimes telecommunication service carriers, not Google.

While Apple controls the hardware and software in iPhones, iPads, and iPods powered by its mobile operating system, Google makes Android available free to device makers who customize the code and update it as they see fit.

More about Drake's research was to be disclosed at a Black Hat computer security conference taking place in Las Vegas early in August.

source: www.abs-cbnnews.com

Google aiming to go straight into car with next Android

SAN FRANCISCO/DETROIT - Google Inc is laying the groundwork for a version of Android that would be built directly into cars, sources said, allowing drivers to enjoy all the benefits of the Internet without even plugging in their smartphones.

The move is a major step up from Google's current Android Auto software, which comes with the latest version of its smartphone operating system and requires a phone to be plugged into a compatible car with a built-in screen to access streaming music, maps and other apps.

Google, however, has never provided details or a timeframe for its long-term plan to put Android Auto directly into cars. The company now plans to do so when it rolls out the next version of its operating system, dubbed Android M, expected in a year or so, two people with knowledge of the matter said.

The sources declined to be identified because they were not authorized to discuss the plans publicly.

"It provides a much stronger foothold for Google to really be part of the vehicle rather than being an add-on," said Thilo Koslowski, vice president and Automotive Practice Leader of industry research firm Gartner, who noted that he was unaware of Google's latest plans in this area.

If successful, Android would become the standard system powering a car's entertainment and navigation features, solidifying Google's position in a new market where it is competing with arch-rival Apple Inc. Google could also potentially access the valuable trove of data collected by a vehicle.

Direct integration into cars ensures that drivers will use Google's services every time they turn on the ignition, without having to plug in the phone. It could allow Google to make more use of a car's camera, sensors, fuel gauge, and Internet connections that come with some newer car models.

Analysts said Google's plan could face various technical and business challenges, including convincing automakers to integrate its services so tightly into their vehicles.

Google declined to comment.

Technology companies are racing to design appliances, wristwatches and other gadgets that connect to the Internet. Automobiles are a particularly attractive prospect because Americans spend nearly 50 minutes per day on average on their commute, according to U.S. Census data.

Apple unveiled its CarPlay software in March and Google has signed on dozens of companies, including Hyundai, General Motors Co and Nissan Motor Co, for its Open Automotive Alliance and its Android Auto product.

Android Auto and CarPlay both currently "project" their smartphone apps onto the car's screen. Many of the first compatible cars with this smartphone plug-in functionality are expected to be on display at the upcoming Consumer Electronics Show in Las Vegas next month and to go on sale in 2015.

By building Android into a car, Google's services would not be at risk of switching off when a smartphone battery runs out of power, for example.

"With embedded it's always on, always there," said one of the sources, referring to the built-in version of Android Auto. "You don't have to depend on your phone being there and on."

Google's software could potentially connect to other car components, allowing, for example, a built-in navigation system like Google Maps to detect when fuel is low and provide directions to the nearest gas stations.

By tapping into the car's components, Google could also gain valuable information to feed its data-hungry advertising business model. "You can get access to GPS location, where you stop, where you travel everyday, your speed, your fuel level, where you stop for gas," one of the sources said.

But the source noted that Android would need major improvements in performance and stability for carmakers to adopt it. In particular, Android Auto would need to power-up instantly when the driver turns the car on, instead of having to wait more than 30 seconds, as happens with many smartphones.

Automakers might also be wary of giving Google access to in-car components that could raise safety and liability concerns, and be reluctant to give Google such a prime spot in their vehicles.

"Automakers want to keep their brand appeal and keep their differentiation," said Mark Boyadjis, an analyst with industry research firm IHS Automotive. "Automakers don't want to have a state of the industry where you get in any vehicle and it's just the same experience wherever you go."

source: www.abs-cbnnews.com