1

According to The Hacker News, many Android devices are running insecure remote ADB service:

Thousands of Android Devices Running Insecure Remote ADB Service

Despite warnings about the threat of leaving insecure remote services enabled on Android devices, manufacturers continue to ship devices with open ADB debug port setups that leave Android-based devices exposed to hackers.

Android Debug Bridge (ADB) is a command-line feature that generally uses for diagnostic and debugging purposes by helping app developers communicate with Android devices remotely to execute commands and, if necessary, completely control a device.

Usually, developers connect to ADB service installed on Android devices using a USB cable, but it is also possible to use ADB wirelessly by enabling a daemon server at TCP port 5555 on the device.

If left enabled, unauthorized remote attackers can scan the Internet to find a list of insecure Android devices running ADB debug interface over port 5555, remotely access them with highest "root" privileges, and then silently install malware without any authentication.

Therefore, vendors are recommended to make sure that the ADB interface for their Android devices is disabled before shipping. However, many vendors are failing to do so.

[...]

Is Android Pie vulnerable to the ADB server attack as mentioned above?

Improve this question
4
  • 3
    That article mentioned that full root access can be granted using adb. It doesn't discusses the RSA fingerprint confirmation needed (since Android 4.2.x) for actual access to Android system, neither it discusses how root access can be granted without presence of su binary or other similar mechanism through adb. I may be wrong here, but the article seems incredibly poor in meaty content or to be precise, lacks proof-of-concept.
    – Firelord ♦
    Commented Mar 20, 2019 at 17:17
  • I very much doubt at least the root part – we would have heard about such an "easy rooting method" years ago. Further, even if USB debugging is enabled, the network part is usually not. And I have never heard of any device that shipped with both enabled. I might have missed something here – but those must be very rare cases, if they really exist (well, "thousands" is very little compared to the multi-million devices that must exist).
    – Izzy
    Commented Mar 20, 2019 at 22:10
  • We did here about this years ago...
    – Empire of E
    Commented Mar 28, 2019 at 11:57
  • It was as easy as running adb reboot and adb shell mount rw,remount /system... The reboot bug was removed around 4.2+
    – Empire of E
    Commented Mar 28, 2019 at 11:59

1 Answer 1

Reset to default
0

The attack is unrelated to a specific Android version (including Pie, Q, and beyond), but to all devices with ADB over network enabled.

[...] it is also possible to use ADB wirelessly by enabling a daemon server at TCP port 5555 on the device.

If left enabled, unauthorized remote attackers can scan the Internet to find a list of insecure Android devices running ADB debug interface over port 5555, remotely access them with highest "root" privileges, and then silently install malware without any authentication.

This is made worse when some manufacturers/vendors ship the device with the setting enabled.

Despite warnings about the threat of leaving insecure remote services enabled on Android devices, manufacturers continue to ship devices with open ADB debug port setups that leave Android-based devices exposed to hackers.

[...]

Therefore, vendors are recommended to make sure that the ADB interface for their Android devices is disabled before shipping. However, many vendors are failing to do so.

For more information: Malware installed with remote debugging

To secure the device, check whether the ADB over network is disabled or not. This setting is available under Developer options, which normally also needs to be enabled first (usually by tapping "Build number" on the Settings 7 times)

To enable Developer options (in general):

  1. Go to Settings - About phone
  2. Tap "Build number" 7 times (or until any notification about developer option already enabled appears)
  3. (If this step doesn't work, check with your device manual or other resources to enable Developer options)

To disable ADB over network:

  1. Go to Settings - Developer options
  2. Check whether the "Developer options" is enabled or not by toggling the switch on the top. If you don't need any features from this setting, disabling it is recommended. However, if you need some features from it but still need to secure the device...
  3. Scroll until the Debugging section, and check whether "Android debugging" and "ADB over network" are enabled or not. Either disable both if you don't need to debug any apps, or just disable "ADB over network" to prevent this attack.
  4. (Otherwise, if you need to use ADB over network, just don't forget to disable it when you end the debugging season)
Improve this answer
2
  • is it possible for a malware to enable usb debugging by itself if it was installed accidentally on the phone ?
    – androidbeginner
    Commented Mar 20, 2019 at 17:18
  • 1
    @androidbeginner that looks like a different question tangential to this issue, please post it as a new question.
    – Andrew T. ♦
    Commented Mar 20, 2019 at 17:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .