More than a month after revealing the Stagefright Android vulnerability, mobile security firm Zimperium has published details about its exploit.
The bug, discovered earlier this year by researcher Joshua Drake, was marked extremely dangerous—an attacker need only have your phone number to carry out a hack via text. No need to open a file or click a link; the attack could happen while you were sleeping, blissfully unaware that private photos, contact details, bank information, and websites were being accessed.
About 95 percent of Android devices, or 950 million smartphones, were vulnerable, the firm said.
Why reveal details, then? Patches have since been released, but concerns remain. Making the code available to the general public lets "security teams, administrators, and penetration testers alike...test whether or not systems remain vulnerable," Zimperium said.
"We're working closely with partners on the Stagefright fix," a Google spokeswoman told PCMag in an email. "Nexus 4/5/6/7/9/10 and Nexus Player are already fixed and will continue to receive monthly security updates that protect users further."
The tech giant released a huge update for Android phones to fight Stagefright, but the issue is widespread.
Google "released new versions of Hangouts and Messenger to block automatic processing of multimedia files arriving via MMS," for example, but "this attack vector constituted only the worst of more than 10 different ways (browsers, instant messengers, etc.) potentially malicious media is processed by the Stagefright library," Zimperium said.
Meanwhile, "myriad researchers [have] flocked to audit the Android code base and collectively discovered and reported numerous additional issues," the firm added.
According to Zimperium, most smartphones running Android 2.2 and later are vulnerable, though those operating versions prior to Jelly Bean are at the highest risk. Owners of SilentCircle's BlackPhone as well as users of Mozilla's Firefox are not affected.
Nvidia said yesterday that its latest update for the Shield tablet includes a security patch for Stagefright.
Drake, meanwhile, presented his research at last month's Black Hat; check out his presentation below.
Editor's Note: This story was updated at 1:10 p.m. Eastern with comment from Google.