At the same time, Android mitigation efforts are making vulnerabilities harder and harder to exploit. That still doesn't mean patches will be immediate, but it means they'll arrive in weeks instead of months, giving attackers less and less time to exploit newly discovered bugs. 'Really, it's the right thing to do,' Segal told The Verge, 'and you're not going to see any pushback from carriers or partners or anything because everybody knows it's the right thing to do.' The widespread public alarm over Stagefright was enough to tip the scales on the new feature. Enterprise customers have long lobbied for better security on the devices, and when a vulnerability in Samsung's Swiftkey keyboard was discovered earlier this summer, the company was impressed by the positive customer response to the quick patch. Samsung's VP of partner solutions Rick Segal says the move to rolling updates has been in the works at Samsung for six months. 'The OEMs are now really understanding and the ecosystem is really understanding how to react more quickly, because we all see that it's necessary.'Īt the same time, the wave of negative publicity around Stagefright seems to have spurred manufacturers into action. 'The early reports triggered a very, very strong response,' Ludwig told The Verge. It's still early, and most devices won't receive the patch until later this month, but Android security head Adrian Ludwig is optimistic that most Android users will be protected by existing mitigation systems, and expects patches to be deployed before attackers can break through. 'The early reports triggered a very, very strong response.' Stagefright seems to have scared manufacturers and carriers into action, and as it turns out, this fragmented ecosystem still has lots of ways to protect itself. Google has announced a similar program for its own Nexus phones. In Samsung's case, the shift has kicked off an aggressive new security policy that will deploy patches month by month, an example that's expected to inspire other manufacturers to follow suit.

Samsung, HTC, LG, Sony and Android One have already announced pending patches for the bug, along with a device-specific patch for the Alcatel Idol 3. Google has had months to write a patch and already had one ready when the bug was announced, but as expected, getting the patch through manufacturers and carriers was complicated and difficult.īut then, something unexpected happened: the much-maligned Android update system started to work. The bug allows an attacker to remotely execute code through a phony multimedia text message, in many cases without the user even seeing the message itself. It's been 10 days since Zimperium's Joshua Drake revealed a new Android vulnerability called Stagefright - and Android is just starting to recover.

What is stagefright vulnerability