Trend Micro reports vulnerability that can put Android Devices dead


Trend Micro has discovered vulnerability in Android that can render a phone apparently dead and silent, unable to make calls, with a lifeless screen. This vulnerability is present from Android 4.3 Jelly Bean up to the current version, Android 5.1.1 Lollipop. No patch has been issued in the Android Open Source Project (AOSP) code by the Android Engineering Team to fix this vulnerability since May 2015.

This vulnerability can be exploited in two ways – either via a malicious app installed on the device, or through a specially-crafted website. The first technique can cause long-term effects to the device. In this technique, an app with an embedded MKV file that registers itself to auto-start whenever the device boots would case the OS to crash every time it is turned on.
The vulnerability is caused by an integer overflow when the media server service parses an MKV file. It reads memory out of buffer or writes data to NULL address when parsing audio data…Read more


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s