> Drake speculates that Stagefright has its excessive permissions and Internet access to satisfy some types of digital rights management processing or streaming playback.
It's a little confused. Stagefright is just a library containing the exploit. The component being (presumably) exploited is the mediaserver process. This is where almost all video decode/encode handling happens in Android (and other related stuff, like audio and camera).
And yes, the mediaserver has internet access so that it can fetch and decode streams on its own without forcing all I/O to go through a user process. Basically it's a performance optimization, though indeed probably one necessitated by having to wall off all that DRM handling in the first place.
That said, mediaserver, while it has lots of access to things that Android apps don't (e.g. open file descriptors to kernel vendor-specific drivers with lets-just-say-questionable security practices), is not a root process. And it's reasonably sandboxed in recent Android versions using selinux. An exploit into it may not be quite as device-cracking as is being claimed.
Certainly not, because the plausible kernel bugs in those open driver descriptors (I'm serious: vendor media drivers are not pretty things) would obviously not be subject to selinux controls.
But at least there is some sandboxing in place; the security architecture was designed to admit the possibility of a breach of the mediaserver.
Link to that reddit thread? AFAICT, all current claims are for a crash exploit into libstagefright, not a breakout of the mediaserver to (for example) persistently write a payload/rootkit.
"The problem is that Stagefright is an over-privileged application with system access on some devices, which enables privileges similar to apps with root access. Stagefright is used to process a number of common media formats, and it’s implemented in native C++ code, making it simpler to exploit
Goddamn you Hollywood.