If you use a phone running any version of Android between 7.0 and 9.0 (Nougat<\/a>, Oreo<\/a>, or\u00a0Pie<\/a>), you ought to immediately install the latest security update \u2013 or risk getting your handset hijacked by devious video malware.<\/p>\n The culprit is a vulnerability in the aforementioned Android versions (CVE-2019-2107<\/a>)<\/span>, which enables hackers to remotely execute arbitrary code by sneaking in \u201cspecially crafted files,\u201d like videos laced with a malicious payload. Once a victim has opened the file, attackers can gain access to their device.<\/p>\n Developer\u00a0Marcin Kozlowski has already\u00a0uploaded<\/a> a proof of concept\u00a0for the\u00a0attack vector on GitHub. \u201cYou can own the mobile [device] by viewing a video with [the malicious] payload,\u201d Kozlowski wrote in the documentation.<\/span><\/p>\n \u201cA possible\u00a0attack vector is opening an unmodified malicious video file,\u201d Kozlowski told TNW. \u201cSuch files can be sent for example via email (the\u00a0Gmail app\u00a0loads video with Android\u2019s stock video player, unless you changed it to another player).\u201d<\/p>\n Fortunately, there are some caveats that make the exploit difficult (but not impossible) to pull off.<\/p>\n For one, the attack will only work if victims load the infectious video in its unmodified state.<\/p>\n In fact, people in the Twitterverse have already speculated that sending the malware via services that re-encode the video \u2013 like YouTube,\u00a0WhatsApp, or Messenger \u2013 will stifle attacks.<\/p>\n Kozlowski seconds this assumption. \u201cIf the video would be touched or re-encoded, which I think messengers do, it would stop the attack,\u201d he told TNW.<\/span> \u201cRe-uploading should break the exploit,\u201d ESET malware researcher Lukas Stefanko<\/a> further told TNW.<\/p>\n While the vulnerability\u00a0is pretty severe, the good thing is that Google has already rolled out<\/a> a security update that fixes the issue.<\/p>\n Indeed, the kink in question was one of the three Media Framework vulnerabilities Google addressed in its July Security Bulletin. \u201cThe most severe vulnerability in this section could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process,\u201d the company wrote.<\/span><\/p>\n It\u2019s difficult to estimate how many devices are at risk, but Google bragged<\/a> there are over 2.5 billion active Android handsets back in May 2019. Out of those, nearly 58 percent (about 1.5 billion) are running versions of Android susceptible to this vulnerability, according to Google\u2019s distribution dashboard<\/a>.<\/p>\n Of course, there\u2019s no telling how many of those phones have been patched with the latest security update. Google didn\u2019t specify the exact number, but a spokesperson told TNW its security team hasn\u2019t seen any evidence of this vulnerability being exploited in the wild.<\/p>\n Earlier in July, Symantec uncovered<\/a> an attack vector that made it possible to manipulate media files \u2013 like videos and images \u2013 on WhatsApp and Telegram. Unlike this Android vulnerability though, the malware Symantec detailed didn\u2019t allow for remote code execution or device takeover.<\/p>\n If you\u2019re running an affected Android version, your best bet would be to update your operating system as soon as possible. Google has already released<\/a> a security update (2019-07-05) that patches this issue. Follow these steps<\/a> to protect yourself.<\/p>\n \n Read next:<\/b>Google has already dropped a fix<\/h2>\n
![\"\"](\"https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2019\/07\/Screen-Shot-2019-07-24-at-14.09.20.png\")
<\/figure>\n<\/p>\n
\n
\n Facebook gets away with $5B FTC fine for leaking your data <\/a>\n<\/p>\n<\/p><\/div>\n