The 2016 Pwnie Nominee For Best Server-Side Bug

Stagefright via MMS (CVE-2015-1538)

Credit: jduck

One billion vulnerable devices that can be targeted and remotely exploited over MMS without user assistance is enough to make a hacker cry out of joy. Watching Google release a new version of the Hangouts app that is automatically updated on those billions of devices within days is enough to make that same hacker cry. Google Play is why we can’t have nice shells things.

Stagefright via MMS (CVE-2015-1538)