Actually I was never thinking about leaving my adb debugging enable on my cellphone when going outside.
Now on cyanogenmod 10 and newer, it asks me to verify the rsa key of the host, which makes really sense.

I have a htc desire z / g2 here which doesn't ask me.
It's running Cyanogenmod 7.2 as this is the newest stable, with no gappsm with Android 2.3.

How can I harden it? I know it can be disabled when the screen is locked, but that's not enough.

  • Disable USB Debugging? – t0mm13b Jan 31 '14 at 14:53
  • Turn off the phone... I want this function so it asks me. Of cource I can turn off... – davidbaumann Jan 31 '14 at 14:55
  • uhhh where did I say turn off the phone? – t0mm13b Jan 31 '14 at 14:57
  • It means I know, I can turn it off. – davidbaumann Jan 31 '14 at 14:57
  • 1
    The prompting of verifying the host by way of RSA Key when plugging in the cable is only found in Jellybean 4.1 and higher, so you're not going to get this on Gingerbread. In short, no other way of hardening adb other then completely disable the USB functionality (both at kernel level and android level) – t0mm13b Jan 31 '14 at 14:59

There is no way to get Gingerbread to prompt the host to verify RSA key as that is found in newer versions of Android (Jellybean 4.1 and upwards).

The only true method of hardening ADB in the sense of prevention of communicating over the USB is to modify the kernel for that appropriate device and disable the USB functionality within it in such a way that when plugging in the USB cable, the kernel does not register it and ignores it as if nothing has happened.

Knock-on side effect - if your device starts boot-looping or mis-behaving, and you want to fix it, it will be trickier to get at it since USB functionality is disabled.

Since OP mentioned its HTC Desire Z, the kernel source should be available on CyanogenMod's repository.

TL;DR: Recompile your own kernel and remove the USB functionality.

Caveat Emptor I am not responsible for any damage if you go down this route in modifying your own kernel.

| improve this answer | |
  • Thank you. I actually don't really want to harden it, just disabling adb should be the right way for me. But I have a solution now, thanks. – davidbaumann Jan 31 '14 at 15:12
  • Glad to be of help :) – t0mm13b Jan 31 '14 at 15:13
  • This application might help you doing this. I haven't tried it personally but it seems exactly like what you'd want, plus some extra stuff. – jadkik94 Feb 6 '14 at 21:01
  • @jadkik94 Uhhh... if you read the wiki - specifically this part Lastly, it also allows you to disable ADBD (the ADB service running on the device that allows you to connect to it through command line from a remote computer) until the next reboot Emphasis mine. – t0mm13b Feb 6 '14 at 21:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.