Tens of thousands of Android devices are leaving their debug port exposed
Countless Android devices are leaving themselves open to attack after being shipped with a critical port left unsecured.
Android Debug Bridge (ADB) is a feature that allows developers to communicate with an Android device remotely, executing commands, and – if necessary – taking full remote control.
As its name suggests, the facility is tremendously useful when it comes to debugging a device and ironing out bugs. However, if not disabled on shipping devices it is open to abuse by criminal hackers.
Security researcher Kevin Beaumont highlighted the danger in a blog post late last week:
It is completely unauthenticated, meaning anybody can connect to a device running ADB to execute commands. However, to enable itâ€Šâ€”â€Šin theoryâ€Šâ€”â€Šyou have to physically connect to a device using USB and first enable the Debug Bridge.
Unfortunately, vendors have been shipping products with Android Debug Bridge enabled. It listens on port 5555, and enables anybody to connect over the internet to a device. It is also clear some people are insecurely rooting their devices, too.
In a nutshell, anyone can remotely access vulnerable devices with God-like “root” privileges, silently install software, and execute malicious code, without any need for a password.
According to Beaumont, vulnerable devices have includes DVRs, mobile telephones, Android smart TVs, and even tankers.
And, according to other researchers, the threat is not theoretical. A network worm called ADB.Miner has been seen scanning across the internet to see where TCP port 5555 used by ADB has been left open, in an attempt to create a cryptomining botnet.
@GossiTheDog inspired me to take a look back at the ADB.Miner worm, which I've been fingerprinting on February. It seems that it lives and it feels pretty well. I've checked out two days (4th, 5th of June) – about 40 000 unique IP addresses. I'll provide some deep analysis soon. pic.twitter.com/HZcTkMPW5o
— chudy (@chudyPB) June 8, 2018
Although it’s difficult to calculate a precise number of devices that may be open for potential attack, Beaumont says “it is safe to say ‘a lot’.”
A guide on the HackTabs website provides a tutorial on how users can check to see if ADB has been enabled on their devices, as well as a means of disabling the feature.
Watch Out for These Ongoing Bank of America Phishing Campaigns Targeting Customers in the US
July 16, 2021
How to protect yourself against cyberstalking
July 06, 2021
The Top Five Security Risks Smartphone Users Face Today
July 02, 2021
Phishing Alert: Scammers Use Fake SharePoint and DocuSign Messages to Steal Users’ Login Credentials
July 02, 2021
Your Doxxing Dossier Will Keep Growing Thicker Until You See the Danger
June 30, 2021
FOLLOW US ON
You might also like
August 05, 2021
August 04, 2021