0

Is it possible for someone to install apks without you noticing, using remote debugging? (E.g. over TCP/IP, or on the same WiFi network). I found articles referring to this after a quick Google, but I'm not sure if they are not just alarmist.

EDIT: This paper seems to talk about something similar - "Android’s External Device Attack: Demonstration and Security Suggestions" - Wei et al.

I was thinking of enabling debugging mode, but this is keeping me from doing it.

  • I see. Can I also check, if some of the built-in software on my Phone has some remote debugging option enabled (e.g. stuff like remote wipe software or the like), which someone could exploit? – purfrock May 31 '15 at 18:13
2

The attack (in question) mentioned in the said research paper would work on a device only when your device is running ADB in TCP/IP mode. You have to specifically give the instructions to bind the ADB on a particular port on your device.

Entering adb help would give one such entry:

adb tcpip <port>             - restarts the adbd daemon listening on TCP on the specified port

Until you restart ADB in TCP/IP mode you're safe from said network attacks (there would be no port opened by ADB to allow access to your device until restarted with aforesaid command).

For surety you can use an app like OS Monitor to see if there are any open ports on your device while running ADB over USB only.

You can enable USB debugging safely. However, other attacks like pushing malicious files or installing APKs et al would definitely work on ADB over USB, so be cautious while handing phones to others.

2

is it possible for someone to install apks without you noticing, using remote debugging?

Yes. First you have to have remote debugging (ADB over TCP/IP) on (typically requires root). Then they have to know your device's IP address and the port number used for ADB over TCP/IP. If done through a malicious app, you would have first had to install the app, and it would need to have a root privilege escalation method to work to enable adb debugging and adb over tcp/ip.

As of Android 4.2, there has been changes to how ADB works. It now requires device Authorization first, over usb. When connected to the right version ADB client, the phone prompts the user to accept the client device fingerprint. Until that happens, the device cannot connect over TCP/IP. After it is authorized once on usb, then it can work over TCP/IP.

Additionally, there is the Verify apps (under security) and Verify apps via ADB (under developer options). This sends details about sideloaded apps to Google for verification, and will block common malware from installing, even via ADB (if checked, naturally). It will not catch everything.

To mitigate this, you just need to follow a few common sense steps. First, use a SU manager, to prevent random root access. Second, keep ADB over TCP/IP disabled until needed. Third, keep Debugging or development disabled. Forth, be wary of any app outside of the Play store.

In short, its possible, but harder to happen since Android 4.2

  • Thanks for the reply! Should I have an SU manager installed even if I haven't rooted my phone? E.g. could legitimate apps (antivirus software or antitheft) have root access without me knowing? – purfrock Jun 1 '15 at 11:31
  • A su manager requires a special su binary file that calls the manager. It only Works if rooted. And no, those types of apps wouldn't have it root. They do tend to have higher rights as they install as device managers – cde Jun 1 '15 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.