Tens of thousands of Android devices are leaving their debug port exposed
Countless Android devices are leaving themselves open to attack after being shipped with a critical port left unsecured.
Android Debug Bridge (ADB) is a feature that allows developers to communicate with an Android device remotely, executing commands, and – if necessary – taking full remote control.
As its name suggests, the facility is tremendously useful when it comes to debugging a device and ironing out bugs. However, if not disabled on shipping devices it is open to abuse by criminal hackers.
Security researcher Kevin Beaumont highlighted the danger in a blog post late last week:
It is completely unauthenticated, meaning anybody can connect to a device running ADB to execute commands. However, to enable itâ€Šâ€”â€Šin theoryâ€Šâ€”â€Šyou have to physically connect to a device using USB and first enable the Debug Bridge.
Unfortunately, vendors have been shipping products with Android Debug Bridge enabled. It listens on port 5555, and enables anybody to connect over the internet to a device. It is also clear some people are insecurely rooting their devices, too.
In a nutshell, anyone can remotely access vulnerable devices with God-like “root” privileges, silently install software, and execute malicious code, without any need for a password.
According to Beaumont, vulnerable devices have includes DVRs, mobile telephones, Android smart TVs, and even tankers.
And, according to other researchers, the threat is not theoretical. A network worm called ADB.Miner has been seen scanning across the internet to see where TCP port 5555 used by ADB has been left open, in an attempt to create a cryptomining botnet.
@GossiTheDog inspired me to take a look back at the ADB.Miner worm, which I've been fingerprinting on February. It seems that it lives and it feels pretty well. I've checked out two days (4th, 5th of June) – about 40 000 unique IP addresses. I'll provide some deep analysis soon. pic.twitter.com/HZcTkMPW5o
— chudy (@chudyPB) June 8, 2018
Although it’s difficult to calculate a precise number of devices that may be open for potential attack, Beaumont says “it is safe to say ‘a lot’.”
A guide on the HackTabs website provides a tutorial on how users can check to see if ADB has been enabled on their devices, as well as a means of disabling the feature.
What is medical identity theft and how to protect against it
July 27, 2022
Identifying and Dealing with Online Bullying Is Not Impossible - School Presentation Inside
June 28, 2022
Let’s Celebrate World Social Media Day by Improving Your Privacy and Security Online
June 28, 2022
Bitdefender Reveals the Top Cyber Threats Faced by Consumers in 2021
June 22, 2022
Scam alert: Cybercrooks use shady investment domain to scam keen investors out of money and data
May 24, 2022