Android may soon restrict on-device ADB • Hacker News Board

Re: Android may soon restrict on-device ADB

#181

Post by realusername » Sat, Jul 25, 2026, 12:35 PM UTC

II2II wrote: post #145

crote wrote: post #119

Earlier quoted context omitted.

It seems to require the user to: 1. Enable Developer Mode by going to an obscure settings page and tapping the build number seven times 2. Enable USB ADB debugging in the Developer Options 3. Establish an actual USB ADB session 4. Enable TCP/IP ADB debugging in the Developer Options 5. Unknowingly download a malware app from the official Play Store 6. Blindly click "Yes" on the permission prompt. In other words: this…

> In other words: this is all but impossible to impact regular users, and it requires a particularly careless developer to be hit by it. Have you ever worked with someone who barely knows how to use a mobile phone? They will hand their phone over to someone they barely even know to do something they don't understand. They will follow instructions from a stranger over the phone, without understanding what the phone is…

You are right, better locking them out of the Play Store, there's too much risk using it.

We could also imagine a 24h delay to get Play Store access with a modal to make them understand the risks.

Re: Android may soon restrict on-device ADB

#182

Post by phoghed » Sat, Jul 25, 2026, 12:41 PM UTC

yyhhsj0521 wrote: post #178

izacus wrote: post #46

Earlier quoted context omitted.

The bug literally describes how they're avoiding OS security restictions by going through the debug port. This is a CVE by any definition and you'd be screaming your head off if any other OS would allow this kind of permission bypass (or even if another app did it). But sure, Google evil.

New CVE found in Bank of America app that may cause user to transfer money to hackers if they press certain combination of keys.

More like if you have some settings enabled someone on your network can do it for you without your permission

Re: Android may soon restrict on-device ADB

#183

Post by BiteCode_dev » Sat, Jul 25, 2026, 12:46 PM UTC

microtonal wrote: post #160

pigggg wrote: post #147

Earlier quoted context omitted.

Millions of Superboxes and various digital picture frames say different. https://synthient.com/blog/a-broken-system-fueling-botnets

Kimwolf exploits vulnerable Android Debug Bridge (ADB) services. Many low-cost TV boxes come "pre-infected" with proxy SDKs; Kimwolf then scans these residential proxy networks and exploits the devices within minutes as it propagates. https://www.cloudflare.com/learning/ddos/glossary/aisuru-kim... This is like saying that SSH is insecure because some device vendors install SSH, permitting root login with a default pa…

Yeah let's block port 80, too many people expose unprotected api.

Re: Android may soon restrict on-device ADB

#184

Post by RunSet » Sat, Jul 25, 2026, 12:52 PM UTC

mlrtime wrote: post #158

g-b-r wrote: post #153

Earlier quoted context omitted.

Can we freaking sell them dumbphones, then, and stop destroying portable computers for everyone else with that excuse? Which incidentally is often just a pretense for other motives? If computers have suddenly become so dangerous for normal people, and they want smartphones nonetheless, add to them a dumb-mode encouraged at the initial setup, and requiring some third party assistance to turn it off once enabled..! (an…

"Can we freaking sell them dumbphones" Nothing is stopping the guy at Walmart or Tmobile from selling them dumbphones, or are you implying they are forced to?

Try letting the blame trickle down from the pyramid's apex instead of blaming the footman.

Here is the first iPhone ad:

https://www.youtube.com/watch?v=6Bvfs4ai5XU

The ad depicts it as a mere phone instead of a potentially hostile Turing machine. There is equivalent messaging in the android ecosystem but its advertising is not so ubiquitous.

Re: Android may soon restrict on-device ADB

#185

Post by wahnfrieden » Sat, Jul 25, 2026, 12:53 PM UTC

lucideer wrote: post #163

microtonal wrote: post #30

I am generally in favor of security improvements, but I do not really see much of a benefit here. This attack vector requires both that the user enabled developer settings and that they have remote adb enabled. So, this does not seem to be a realistic attack vector for 99.9% of the users and most of the other 0.1% probably know what they are doing. The other proposed change (to restrict access to certain interfaces o…

This. I'm a developer, I've published Android apps, & I've still managed to lose access to a device that had dev settings enabled purely because remote adb enablement is a (extremely fiddly) toggle that happened to be off on the device at the time the screen broke. Having these two enabled simultaneously is such a rare case in the wild as to be entirely negligible as a vector.

Sometimes attacks happen from users being instructed to enable settings in order to achieve something regardless of whether you’d expect them to have a reason to use the setting

Re: Android may soon restrict on-device ADB

#186

Post by atty » Sat, Jul 25, 2026, 12:59 PM UTC

wahnfrieden wrote: post #185

lucideer wrote: post #163

Earlier quoted context omitted.

This. I'm a developer, I've published Android apps, & I've still managed to lose access to a device that had dev settings enabled purely because remote adb enablement is a (extremely fiddly) toggle that happened to be off on the device at the time the screen broke. Having these two enabled simultaneously is such a rare case in the wild as to be entirely negligible as a vector.

Sometimes attacks happen from users being instructed to enable settings in order to achieve something regardless of whether you’d expect them to have a reason to use the setting

Sure, sometimes people get social engineered into taking money from their bank account and giving it to criminals. Should banks stop allowing withdrawals?

Re: Android may soon restrict on-device ADB

#187

Post by Eueudhsbsj32 » Sat, Jul 25, 2026, 1:02 PM UTC

LightBug1 wrote: post #135

"AI ... please create a very efficient emulator which will take an Android app, and convert it to any other operating system" Anyone up for the challenge? Or a better solution. Fuck this bullshit. It's only going to get worse.

If only it were that simple. Anything important like banking apps will require attestation.

Re: Android may soon restrict on-device ADB

#188

Post by miroljub » Sat, Jul 25, 2026, 1:03 PM UTC

PunchyHamster wrote: post #98

microtonal wrote: post #30

I am generally in favor of security improvements, but I do not really see much of a benefit here. This attack vector requires both that the user enabled developer settings and that they have remote adb enabled. So, this does not seem to be a realistic attack vector for 99.9% of the users and most of the other 0.1% probably know what they are doing. The other proposed change (to restrict access to certain interfaces o…

It's not because of security. It's to slowly close any avenues for side-loading stuff

It's not side loading. Word you are looking for is called "installing".

Re: Android may soon restrict on-device ADB

#189

Post by freedomben » Sat, Jul 25, 2026, 1:04 PM UTC

II2II wrote: post #145

crote wrote: post #119

Earlier quoted context omitted.

It seems to require the user to: 1. Enable Developer Mode by going to an obscure settings page and tapping the build number seven times 2. Enable USB ADB debugging in the Developer Options 3. Establish an actual USB ADB session 4. Enable TCP/IP ADB debugging in the Developer Options 5. Unknowingly download a malware app from the official Play Store 6. Blindly click "Yes" on the permission prompt. In other words: this…

> In other words: this is all but impossible to impact regular users, and it requires a particularly careless developer to be hit by it. Have you ever worked with someone who barely knows how to use a mobile phone? They will hand their phone over to someone they barely even know to do something they don't understand. They will follow instructions from a stranger over the phone, without understanding what the phone is…

Following this logic, shouldn't we just ban smart phones for everyone then? If we need to dumb down all technology to the absolute lowest level, we should probably ban computers or at least require an official government-controlled license to get access to one. Is this a world you want to live in? Me neither.

Re: Android may soon restrict on-device ADB

#190

Post by franga2000 » Sat, Jul 25, 2026, 1:06 PM UTC

pigggg wrote: post #147

franga2000 wrote: post #137

Earlier quoted context omitted.

You haven't been able to connect to an android device on port 5555 for yeeears. Every time you enable adb/IP it generates a new random port, or you need to use the QR/PIN pairing thing. On top of needing to enable developer options, adb/IP, confirm the fingerprint.

Millions of Superboxes and various digital picture frames say different. https://synthient.com/blog/a-broken-system-fueling-botnets

Well yes, but those won't get Google's new updates either. Open ADB on 5555 was a problem we solved almost a decade ago and these devices are still vulnerable. Even further restricting ADB in the latest version won't do anything to prevent that.