Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android may soon restrict on-device ADB

kitsumed.github.io

Post reply on HN
Print view View original

61–70 of 535 posts

Re: Android may soon restrict on-device ADB

#61

Post by roer »

izacus wrote: post #46
microtonal wrote: post #30

I am generally in favor of security improvements, but I do not really see much of a benefit here. This attack vector requires both that the user enabled developer settings and that they have remote adb enabled. So, this does not seem to be a realistic attack vector for 99.9% of the users and most of the other 0.1% probably know what they are doing. The other proposed change (to restrict access to certain interfaces o…

The bug literally describes how they're avoiding OS security restictions by going through the debug port. This is a CVE by any definition and you'd be screaming your head off if any other OS would allow this kind of permission bypass (or even if another app did it). But sure, Google evil.

The original issue is proposing letting the user assign the debug service to a specific interface, one of which would presumably be loopback. This article is about the proposal from a developer that it should only ever be assigned to wlan0, which would break a lot of apps.

Letting applications bypass permissions with this feature is the exact usecase they don't want to lose. If anything, I don't see them being against the original proposal possibly restricting non-loopback access, which would enhance security.

Re: Android may soon restrict on-device ADB

#64

Post by zmmmmm »

izacus wrote: post #46
microtonal wrote: post #30

I am generally in favor of security improvements, but I do not really see much of a benefit here. This attack vector requires both that the user enabled developer settings and that they have remote adb enabled. So, this does not seem to be a realistic attack vector for 99.9% of the users and most of the other 0.1% probably know what they are doing. The other proposed change (to restrict access to certain interfaces o…

The bug literally describes how they're avoiding OS security restictions by going through the debug port. This is a CVE by any definition and you'd be screaming your head off if any other OS would allow this kind of permission bypass (or even if another app did it). But sure, Google evil.

Even if you have to deliberately enable a setting and enter a pairing code?

It's like saying that the fact the user knows their own password is a vulnerability because they might enter it to log into their account.

Re: Android may soon restrict on-device ADB

#65

Post by mrsssnake »

izacus wrote: post #46
microtonal wrote: post #30

I am generally in favor of security improvements, but I do not really see much of a benefit here. This attack vector requires both that the user enabled developer settings and that they have remote adb enabled. So, this does not seem to be a realistic attack vector for 99.9% of the users and most of the other 0.1% probably know what they are doing. The other proposed change (to restrict access to certain interfaces o…

The bug literally describes how they're avoiding OS security restictions by going through the debug port. This is a CVE by any definition and you'd be screaming your head off if any other OS would allow this kind of permission bypass (or even if another app did it). But sure, Google evil.

"...avoiding OS security restictions by going through the debug port..." the user delibretry opened and paired to app with clear visual confirmation in order to use it.

Re: Android may soon restrict on-device ADB

#66

Post by avian »

IvanK_net wrote: post #41

I am worried that this might happen to websites soon. If you want your website to be openable on Apple devices, you would have to pay Apple a fee each month. If you want your website to be openable on Android devices, you would have to pay Google a fee ecah month, etc.

I am thinking how this would split the web.

You would have the "new web" consisting of the top n major websites paying this fee.

And then you would have the "old web", accessible only to people still owning their own PCs with unrestricted browsers. And probably heavily scrapped by AI companies to reguritate to the masses through the new web.

Re: Android may soon restrict on-device ADB

#67

Post by izacus »

theplumber wrote: post #53
izacus wrote: post #46

Earlier quoted context omitted.

The bug literally describes how they're avoiding OS security restictions by going through the debug port. This is a CVE by any definition and you'd be screaming your head off if any other OS would allow this kind of permission bypass (or even if another app did it). But sure, Google evil.

Depends how you define a CVE. If owning and controlling your device is a CVE/bug then sure you need a tight box with anti tempering as well.

"An app can bypass OS security system with certain setting enabled" absolutely fits into CVEs. There's no "depends: on it.

I love how quickly you all forget about security and privacy when it gives a chance to angrily rant.

Re: Android may soon restrict on-device ADB

#68

Post by dminik »

3form wrote: post #58
izacus wrote: post #46

Earlier quoted context omitted.

The bug literally describes how they're avoiding OS security restictions by going through the debug port. This is a CVE by any definition and you'd be screaming your head off if any other OS would allow this kind of permission bypass (or even if another app did it). But sure, Google evil.

Because you know, the actual solution would be to have more granularity in authentication process than "allow whole device to attach to ADB", but that would be like, difficult... so they're not going to so that. Right now any app on my PC connected to ADB could manipulate my phone then, and that's somehow not a CVE?

Is it a CVE that an app running on my PC could actually be running under GDB? It's the entire purpose of these tools.

Re: Android may soon restrict on-device ADB

#69

Post by izacus »

light_hue_1 wrote: post #50
p-e-w wrote: post #26

Earlier quoted context omitted.

The implication in the blog post that Google developers somehow “overlooked” or “misunderstood” important use cases here, and if only they were informed about them they would reconsider, is frankly insulting.

Every single time any story has the words "Google developers" in it, they're behaving like arrogant, disconnected, anti-consumer jerks. From constant GCP breakage, to not acknowledging obvious Android bugs, to intentionally braking Chrome. It's a stark contrast to behind the scenes interactions with them.

[flagged]

Re: Android may soon restrict on-device ADB

#70

Post by jorvi »

SXX wrote: post #32
Arbortheus wrote: post #5

Earlier quoted context omitted.

Toxic max security. Not everyone has the same threat model as you, $BIGTECHCORP.

They dont care about security; only about control. There are hundreds of millions of outdated Android devices that all Google attestation systems consider secure even though they all running Linux kernel that was never ever updated and can be rooted by anything. Now try to install your own firmware on them without said outdated kernel... How dare you.

Technically the security works, just for their threat model. An exploit would need root and root means you likely cannot pass attestation AFAIK. The fact that this same exploiter can download all your contacts photos and texts is immaterial to, say, Disney, who want attestation only to prevent ripping of their content.
Post reply on HN