Old Android vulnerability unearthed by Trend Micro could make your Android device silent and unresponsive

Security firm Trend Micro is ringing bells, announcing a vulnerability in Android's mediaserver service that lets malicious code cripple your device, making it silent (no ring tone, text tone, or notification sounds can be heard) and completely unresponsive (meaning a locked device cannot be unlocked). The exploit is present in Android versions starting from v4.3 (Jelly Bean) all the way through v5.1.1 (Lollipop). It is yet to be patched up, although the Android engineering team acknowledged it as a "low priority" vulnerability in the end of May.

Trend Micro explains that the mediaserver service, where the vulnerability is contained, is used by Android to index the media files contained on the device's storage. If a MKV video file is malformed in the right way, it will crash the service and the rest of the operating system upon attempting to process it. This tactic can be exploited in multiple ways, depending on the attacker's creativity and intent. Trend Micro gives two examples — an app with an embedded malicious MKV file that starts with the device's boot, or through a specially engineered website.

The latter approach has been demonstrated by the firm in the video below. Although the mobile version of Chrome disables the preloading and autoplay of video files, the browser still reads the malicious MKV file until the mediaserver service crashes. The code causes an integer buffer overflow to take place, causing the system to crash.