Daily Archives: April 30, 2016

Google Releases Security Updates for Android (April 2016)

In the first week of April; Google made available a scheduled security update for their Android smartphone operating system. Android devices with a security patch level of April 2, 2016 include all of the fixes within Google’s most recent security advisory.

The April updates resolve 39 security vulnerabilities more formally known as CVEs (defined) of the following severities:

15x critical severity CVEs
16x high severity CVEs
8x moderate severity CVEs

Why Should These Issues Be Considered Important?
On the 18th of March Google released an out of band (unscheduled) security update to resolve a local elevation of privilege (defined) vulnerability.

This vulnerability was present in the Android kernel (defined). This issue was used in a public exploit against a Google Nexus 5 and was detected by security firm Zimperium who then reported it to Google on March 15th.

This issue was assigned a critical severity rating since it escalates privileges on a vulnerable Android device which can lead to arbitrary code execution (instructions of an attacker choice can be carried out) as well as permanently compromising the device (which can only be resolved by re-flashing the device as described in a previous blog post).

Other critical issues resolved by this update were present in the DHCP (defined) service known as DHCPCD. This could have been exploited by an installed malicious app allowing an attacker to run (carry out) arbitrary code execution. The remaining critical issues involved the Qualcomm Performance Module and RF driver (defined). Exploitation would have allowed an attacker to run code with the same privileges as the Android kernel. Both of these issues if exploited would require re-flashing an affected device since they lead to a permanent device compromise.

Finally, 13 issues (of critical and high severity) that are related to the previous Stagefright vulnerabilities were also resolved. These vulnerabilities continue to arise due to the increased attention towards the MediaServer component of Android from security researchers after last year’s disclosure of the original Stagefright issue.

How Can I Protect Myself From These Issues?

Updates to resolve these issues were made available by Google on 4th of April 2016. Manufacturers such as Samsung/LG etc. received these updates on the 16th of March.

As mentioned by Sophos you may need to ask your device manufacturer or mobile carrier when this update will be made available to you. As discussed in a previous post regarding Android updates, please ensure to only apply updates from your mobile carrier or device manufacturer.

In my previous post discussing Android security updates; I mentioned that a single update to my Sony smartphone was made available on the 8th of March. At the time of writing I still have not received this update. As before, I hope that you are more successful with your phone receiving the appropriate update as soon as possible.

Thank you.

Google Releases Security Update for Chrome (April 2016)

Earlier this week Google released an update for Google Chrome bringing it to version 50.0.2661.94. This updated version resolves 9 security issues assigned to 7x CVE numbers (defined). The severity levels of these issues are detailed below:

  • 4x high severity
  • 2x medium severity
  • 1x remaining uncategorized issue

Google Chrome updates automatically and will apply the update the next time Chrome is closed and then re-opened. Chrome can also be updated immediately by clicking the Options button (it looks like 3 stacked small horizontal lines, sometimes called a “hamburger” button) in the upper right corner of the window and choosing “About Google Chrome” from the menu. Follow the prompt to Re-launch Chrome for the update to take effect.

As always full details of the update were made available by Google in a blog post. If you use Google Chrome as your web browser, please consider updating it as soon as possible. Thank you.