1

I have two smartphones running Android 10 and 8, The ADB is enabled for many proposes. Generally some vendors have been shipping products with Android Debug Bridge enabled. But it seems that enabling ADB have many security risks according to DoublePpulsar blog: Root Bridge — how thousands of internet connected Android devices now have no security, and are being exploited by criminals.

This is highly problematic as it allows anybody — without any password — to remotely access these devices as ‘root’* — the administrator mode — and then silently install software and execute malicious functions.

Does the latest Android releases are secure against the ADB vulnerability?

Improve this question
2
  • 3
    " without any password"? RSA key authentication was added to Android 4.2, 8+ years back: android.stackexchange.com/a/219320/218526
    – Irfan Latif
    Apr 5, 2021 at 16:56
  • 2
    The log article mixes up ADB with ADB over IP. For both the RSA authentication is required if you use a Google Android certified phone. What dumb chinese manufacturers do by enabling both ADB modes by default and disable RSA authentication is their problem. Just don't buy those cheap China phones.
    – Robert
    Apr 5, 2021 at 18:24

1 Answer 1

Reset to default
4

Sorry but it seems Kevin Beaumont from Microsoft has no clue what he is talking about. Mythbusters would proof him wrong..

It is completely unauthenticated, meaning anybody can connect to a device

That is simply not true. Even on rooted android TV boxes (where the adb miner supposed to run) one still must have access to home network (which is not possible through NAT/Firewall)

Furthermore it requires at least one initial authorization of the RSA-Key from the host which is trying to connect - user must explicitly confirm this on tv screen with remote control (android tv box)

the analysis is based on open port scan where ~ 5000 devices in asia found open port 5555. But just open port means nothing. At least, according Hui Wang these adb miner did not succeed at all

Till now, zero coins have been paid, as can be seen in below zero_incoming_till_now.png

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .