3

A new exploit is said to exploit MMS loading.

For now, there's not much end users can do to protect themselves other than to install a patch as soon as one becomes available for their specific Android device. People can also prevent MMS messages from automatically loading in Google Hangouts or other text apps. That will prevent malicious code from being automatically loaded [...]

How to disable automatic loading of MMS messages?

If it depends on the app, the procedure for the most popular apps would be appreciated.

Nicolas Raoul
  • 5,266
  • 14
  • 58
  • 90

2 Answers2

3

Nicolas, possible solutions very much depend on how far you will go (and partly, how far your carrier goes along). There is no 100% cure, but a few items you might consider:

  • Say Goodbye to Hangouts. If you can live without that app, make another one the default SMS/MMS handler and don't use Hangouts – at least not until Google fixed that "autoplay". I'd expect an update there soon where you can at least disable that autoplay feature.
  • Disable your MMS APN. This of course you can do only if you can live without MMS altogether (I can: didn't get a single MMS in the 20 years I'm using mobiles – and the only one sent to me never reached my device because of carrier policies: to receive, I had first to send an MMS, which I never did). And apart from that, this might or might not work: I know of providers ignoring APNs, at least for the normal Internet connection (which then works even if you have no APN at all configured – they somehow fix that at their end).
  • Ask your carrier if MMS can at least temporarily "switched off" somehow from their end. They should have those capability: If you e.g. send an MMS to someone having a non-MMS-capable dumbphone, they'd send that person a link to where to read the MMS with a browser. You then could use a web browser at your PC to read the MMS – where Android-specific exploits had a hard time dealing with OSX, Windows, or Linux :)

Afraid only few of us can hope for OS updates to really fix that. Though, when under warranty, one might try pressing them: depending on how one uses the device, this bug might very much "render it unuseable" for daily use without the user's fault – which in my eyes is a case for warranty: fix it or have it back. Enough people with this argument, and some with good lawyers … might make them think twice ;)

Izzy
  • 91,166
  • 73
  • 343
  • 943
0

Don't use or disable autoloadind MMS in hangouts (Don't know the procedure myself since I don't use it). The patch was already commited in AOSP around two weeks ago so for a fix for this "new exploit" if you use an OEM rom, you should contact your carrier/vendor.

Any custom rom like Cyanogenmod should already have this fixed.

https://plus.google.com/u/0/+CyanogenMod/posts/7iuX21Tz7n8

xangua
  • 287
  • 3
  • 7
  • I asked because I expect many people to have this question. Many of these people have carriers who don't care about pushing updates. – Nicolas Raoul Jul 28 '15 at 07:52
  • @NicolasRaoul carriers should neither sell phones or push updates. BYOD like land lines and PC's – pcnate Jun 01 '17 at 11:47