Tens of thousands of Android devices are leaving their debug port exposed

Countless Android devices are leaving themselves open to attack after being shipped with a critical port left unsecured.

Android Debug Bridge (ADB) is a feature that allows developers to communicate with an Android device remotely, executing commands, and – if necessary – taking full remote control.

As its name suggests, the facility is tremendously useful when it comes to debugging a device and ironing out bugs. However, if not disabled on shipping devices it is open to abuse by criminal hackers.

Security researcher Kevin Beaumont highlighted the danger in a blog post late last week:

It is completely unauthenticated, meaning anybody can connect to a device running ADB to execute commands. However, to enable it — in theory — you have to physically connect to a device using USB and first enable the Debug Bridge.

Unfortunately, vendors have been shipping products with Android Debug Bridge enabled. It listens on port 5555, and enables anybody to connect over the internet to a device. It is also clear some people are insecurely rooting their devices, too.

In a nutshell, anyone can remotely access vulnerable devices with God-like “root” privileges, silently install software, and execute malicious code, without any need for a password.

According to Beaumont, vulnerable devices have includes DVRs, mobile telephones, Android smart TVs, and even tankers.

And, according to other researchers, the threat is not theoretical. A network worm called ADB.Miner has been seen scanning across the internet to see where TCP port 5555 used by ADB has been left open, in an attempt to create a cryptomining botnet.

@GossiTheDog inspired me to take a look back at the ADB.Miner worm, which I've been fingerprinting on February. It seems that it lives and it feels pretty well. I've checked out two days (4th, 5th of June) – about 40 000 unique IP addresses. I'll provide some deep analysis soon. pic.twitter.com/HZcTkMPW5o

— chudy (@chudyPB) June 8, 2018

Although it’s difficult to calculate a precise number of devices that may be open for potential attack, Beaumont says “it is safe to say ‘a lot’.”

A guide on the HackTabs website provides a tutorial on how users can check to see if ADB has been enabled on their devices, as well as a means of disabling the feature.