Google encourages security research: The Android Security Rewards Program, launched in 2015, and Google Patch Rewards program, launched in 2014, rewards the contributions of security researchers who invest their time and effort in helping make Android more secure.Anyone can conduct research and also make contributions to improve Android security.

This means anyone can review it to understand how it works and to identify potential security risks.

The open ecosystem improves security and makes Android stronger: Android is open source.

Security is baked into Android: Android applications run in what we call an 'Application Sandbox.' Just like the walls of a sandbox keep the sand from getting out, each application is housed within a virtual 'sandbox' to keep it from accessing anything outside itself, meaning that even if a user were to accidentally install a piece of malware, it's forbidden from accessing other parts of the device.

According to Drakem 'Google acted promptly and applied the patches to internal code branches within 48 hours.'Ī Google spokesperson added in an e-mail response that, 'The security of Android users is extremely important to us, so we've already responded quickly to this issue by sending the fix for all Android devices to our partners.' In the meantime, Zimperium informed Google of the problem in April. Drake will reveal the full details of how Stagefright works at Black Hat in early August. Its security hole appears to be that to reduce video viewing lag time Stagefright automatically processes the video before you even think about watching it. This media playback engine comes with software-based codecs for several popular media formats and is used for audio and video playback. This security hijack works by taking advantage of Android's built-in Stagefright media library. If, on the other hand, you're using Android's standard Messenger app you must open the text message - but not necessarily watch the video - to get hacked. This can happen so fast that by the time your phone alerts you that a message has arrived, you've already been hacked. It then opens up your device, and the attack starts. All the attacker needs to do is send a poisoned package to your phone number. If you're using Google's Hangouts app, you don't even need to open your text message app. The really sneaky part is you don't need to watch the playful cats. For example, a short video of kittens playing could be used to put malware on your system. Stagefright holds up your device by being sent to you as a multimedia text message.

Using a verified boot process, Google will make Android safer by warning device owners if their software has been tampered with. Lock it down: Google shows off Android's boot verification warning system

What is stagefright vulnerability