A major flaw in Android phones can give hackers access to millions of users’ personal data with just a simple text, according to a security firm.
Security company Zimperium uncovered the vulnerability, which researchers say exists in the media playback tool built into Android called Stagefright, CBS News reports.
Hackers could take advantage of the vulnerability by sending a text message including a video file that contains malware to an Android device. The video file contains a string of malicious coding that will activate once the text is received.
Once the text is received by the smartphone (users don’t even have to watch the video), hackers would have complete control over the handset, allowing them to steal anything on the phone, including credit card numbers or other personal information, CNET reports.
Zimperium said 95 percent of Android devices worldwide are vulnerable; however, the security firm told National Public Radio that hackers have not exploited the flaw yet.
Additionally, Zimperium notified Google – the company behind Android – about the vulnerability when it first discovered the flaw in April. The security firm says it also supplied patches that would fix the problem.
In a statement, Google noted that it took immediate action to fix the issue once it became aware of the vulnerability. The company also noted that it offers rewards programs to encourage security researchers to report any flaws they find and help make the system more secure.
Despite the security patch, however, Android users are still at risk, according to Zimperium. The firm estimates only about 20 percent to 50 percent of Android devices currently in consumers’ hands will actually get the updates due to vendors being slow to react.
In 2014, more than 1 billion Android devices shipped worldwide, according to researcher Strategy Analytics, which expects the number to rise in 2015 and beyond.
