After reading the case study:

1. Summarize the issues that caused the vulnerability presented in the Stagefright case. Detail the risks caused to the device that was vulnerable and identify plausible mitigation steps.
2. Provide details about the technical item that causes the issue.
3. Compare the Stagefright case with another case. Discuss the approach for the resolution.

Android users are often the target of cybercriminals. This is due to a couple of factors: Android is the most popular mobile platform worldwide, and it is fragmented. This means that there are many different versions in use at one time. Once a bug or vulnerability is detected, it must be patched by Google in the next OS version. Meanwhile, most users will never apply the patches or newer software versions.

In early 2015 Joshua Drake of Zimperium, a security researcher, discovered that a vulnerability allowed an Android device to be attacked by receiving a malicious multimedia message. If exploited, an unauthorized remote code execution and privilege escalation attack could be levied. This was thought to have been the largest potential impact on Android users, leaving 95 percent of them vulnerable to the attack.

Known as Stagefright, this vulnerability is known to exist in version 2.2 (Froyo) and newer versions of Android. Due to a flaw in a C++ library called Stagefright, a core component of Android, this exploit can be launched remotely using only the targets mobile number, and it requires no end-user interaction. It provides a back-end engine for opening and playing multimedia content.

In 2015 two additional Stagefright vulnerabilities were discovered: CVE-2015-3864 and CVE-2015-6602. Each of these vulnerabilities impacts different libraries within the Android operating system than the original Stagefright. For example, one of the vulnerabilities leverages specially crafted MP3 and MP4 files that can execute their payload using the Android media server modules on the Android phone. There have been other attacks that have caused similar issues, such as by opening or downloading a malicious multimedia file using the devices web browser. Initially, the issue was thought to be related to the address space layout randomization (ASLR) feature; however, later Stagefright exploits bypass ASLR. Even today, many Android phones and devices are vulnerable to these, or similar, attacks.