Industry News

Tens of thousands of Android devices are leaving their debug port exposed

Countless Android devices are leaving themselves open to attack after being shipped with a critical port left unsecured.

Android Debug Bridge (ADB) is a feature that allows developers to communicate with an Android device remotely, executing commands, and – if necessary – taking full remote control.

As its name suggests, the facility is tremendously useful when it comes to debugging a device and ironing out bugs. However, if not disabled on shipping devices it is open to abuse by criminal hackers.

Security researcher Kevin Beaumont highlighted the danger in a blog post late last week:

It is completely unauthenticated, meaning anybody can connect to a device running ADB to execute commands. However, to enable it — in theory — you have to physically connect to a device using USB and first enable the Debug Bridge.

Unfortunately, vendors have been shipping products with Android Debug Bridge enabled. It listens on port 5555, and enables anybody to connect over the internet to a device. It is also clear some people are insecurely rooting their devices, too.

In a nutshell, anyone can remotely access vulnerable devices with God-like “root” privileges, silently install software, and execute malicious code, without any need for a password.

According to Beaumont, vulnerable devices have includes DVRs, mobile telephones, Android smart TVs, and even tankers.

And, according to other researchers, the threat is not theoretical. A network worm called ADB.Miner has been seen scanning across the internet to see where TCP port 5555 used by ADB has been left open, in an attempt to create a cryptomining botnet.

Although it’s difficult to calculate a precise number of devices that may be open for potential attack, Beaumont says “it is safe to say ‘a lot’.”

A guide on the HackTabs website provides a tutorial on how users can check to see if ADB has been enabled on their devices, as well as a means of disabling the feature.

About the author

Graham CLULEY

Graham Cluley is an award-winning security blogger, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by companies such as Sophos, McAfee and Dr Solomon's. He has given talks about computer security for some of the world's largest companies, worked with law enforcement agencies on investigations into hacking groups, and regularly appears on TV and radio explaining computer security threats.

Graham Cluley was inducted into the InfoSecurity Europe Hall of Fame in 2011, and was given an honorary mention in the "10 Greatest Britons in IT History" for his contribution as a leading authority in internet security.

Add Comment

Click here to post a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.