Bad News: Security Hole Can Let An Attacker Take Over Your Android Phone With A Single Text

Consumerist

. ...

The damage travels by text, Forbes reports, and takes advantage of a weakness in a piece of code called Stagefright.
Stagefright is a tool Android uses to play back media — any text you get that’s an MMS (as opposed to an SMS) is played back to you using Stagefright. Any app that can read your text messages sits on top of that code, from Google Hangouts to your pre-installed default “Messaging” program.

. ...

The level of access attackers would gain would allow access to files stored on SD cards as well as on the phone memory. Attackers could also turn your phone into a bug, remotely recording audio and video without your knowledge. Bluetooth access is also hackable via Stagefright. All versions of Android from 2.2 and up are considered vulnerable.

If that sounds terrifying, well, it kind of is. And then it gets worse. The exploit isn’t like a virus-laden e-mail attachment; you don’t actually have to try to view the media in order to be affected. Merely looking at the message in some apps is enough.

And then there are the apps where you don’t even have to open the message: for folks who use Google Hangouts to read their texts, Hangouts would open and access the exploit code “immediately before you even look at your phone... ...

The good news is, after Drake reported his findings, Google has verified and corrected seven security holes. But here’s the bad news: Google doesn’t update Android phones directly. Service providers do. ... and they are not known for doing so quickly.

More
http://consumerist.com/2015/07/27/bad-news-security-hole-can-let-an-attacker-take-over-your-android-phone-with-a-single-text/