3

I have a Android 8 TV box. In developer settings, I can enable/disable USB debug. After enable, any device in LAN can use adb connect <ip> to connect to (no password or auth required) and control it via shell.

My questions:

  1. Does that mean any app on the Android devices can connect 127.0.0.1:5555 and get a shell permission? (The Android box is rooted. In adb I can use su directly)

    ss -pnltu | grep 5555 got:

    tcp    LISTEN     0      4        :::5555                 :::*                   users:(("adbd",pid=5051,fd=15))

    How can I protect my Android from being hacked by an installed app.

  2. I can't use setprop ro.adb.secure 1, it says

    setprop: failed to set property 'ro.adb.secure' to '1'

    It's always 0. So the ROM doesn't support the adb RSA auth security feature.

    How can I protect my Android from being hacked from other LAN devices.

(I want to keep usb debugging on cause I can install/uninstall apps from PC)

Update: I come up with a simple trick: changing the port

setprop service.adb.tcp.port 5550

that will hide my adbd from 80% hackers I think.

But, still, that's not a real solution. It's just a workaround

Improve this question
1
  • although hypothetical vulnerability exist I wouldn't care much as you have full control over your LAN don't you? You can modify boot.img or system.img default.prop and flash it back to device. or install Magisk and use the resetprop feature
    – alecxs
    Commented Feb 12, 2022 at 15:32

1 Answer 1

Reset to default
2

If there is no adb authentication any device on your network can connect and issue shell commands.

A workaround could be to limit access to adb on IP level using iptables. That would allow to limit access your PC, assuming that your PC always has the same IP in your home network.

But as you have root permissions you may consider installing an sshd and keep adb off. The authentication system of ssh is effective and additionally ssh provides an encrypted communication channel (which adb doe snot provide, it is plain like telnet).

Improve this answer
2
  • Thank you for the sshd advice. I have considered that before also. For the purpose of getting shell, ssh is enough. But when I want to use scrcpy or adb install, still have to turn network adb on
    – Bob Johnson
    Commented Feb 12, 2022 at 13:58
  • 1
    @BobJohnson adb install ist more or les the combination of adb push and pm install (command on device). So installing apps via ssh should be possible. And even scrcpy migtht work somehow in github.com/Genymobile/scrcpy/issues/1421 there are listed some possibilities.
    – Robert
    Commented Feb 12, 2022 at 15:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .