Earlier quoted context omitted.
This. I'm a developer, I've published Android apps, & I've still managed to lose access to a device that had dev settings enabled purely because remote adb enablement is a (extremely fiddly) toggle that happened to be off on the device at the time the screen broke. Having these two enabled simultaneously is such a rare case in the wild as to be entirely negligible as a vector.
Sometimes attacks happen from users being instructed to enable settings in order to achieve something regardless of whether you’d expect them to have a reason to use the setting
Android may soon restrict on-device ADB
311–320 of 535 posts
Re: Android may soon restrict on-device ADB
#312Earlier quoted context omitted.
Depends how you define a CVE. If owning and controlling your device is a CVE/bug then sure you need a tight box with anti tempering as well.
Can you provide a reasonable definition where an authentication bypass in ADB doesn't qualify as a vulnerability? Is there a use case for allowing anyone on your network to run adb commands without your approval? There are 3 things which I feel like are being confused here: 1. There was a genuine authentication bypass vulnerability in ADB (bad) 2. Initial proposed change wants to add an option to limit the ADB server…
Re: Android may soon restrict on-device ADB
#313Earlier quoted context omitted.
Sometimes attacks happen from users being instructed to enable settings in order to achieve something regardless of whether you’d expect them to have a reason to use the setting
Sometimes people fall down the stairs in their own homes. That doesn't mean the government should mandate everybody to wear helmets at home does it? A measure needs to be in proportion to the actual risk it seeks to mitigate.
Re: Android may soon restrict on-device ADB
#314Earlier quoted context omitted.
This is all inevitable direction over long period of time What’s worrying is that noone protests about it It doesn’t suprise me that corporations and governments want the laziest, most „protective” laws passed that extend their power. But why noone, absolutely noone puts some kind of resistance to it? Government and citizens are at eternal conflict of interests. It has been this way and it will be this way forever. Y…
The frogs are almost done, and the silicone figurines that used to impost actual frogs and croak how pleasant the water is and how it should always keep getting warmer to keep everyone comfortable, will soon be removed from the pot, their duties fullfilled.
Re: Android may soon restrict on-device ADB
#315Does anyone have any doubt left that we're headed for a future where you need a government ID to use any computing device, and only allowed to do government-approved tasks and view government-approved content? Not a rhetorical tinfoil question: Does anyone still believe there's some hope for personal freedoms?
> Does anyone still believe there's some hope for personal freedoms? as long as such personal freedoms gives users the ability to skirt the profit motives of companies making these devices, there will always be a force to try restrict it. The internet, as it has been, is quite an anomaly, but inevitably, power that the people have gets usurped one way or another. It's just a matter of time.
It's not an anomaly, it was the data grabbing infrastructure, and now that enough data is vacuumed in from it to train AI, it is now time to turn this dangerously conductive communication network into a control-only one, by all logic of the process and those who funded it all the way.
Re: Android may soon restrict on-device ADB
#316I am generally in favor of security improvements, but I do not really see much of a benefit here. This attack vector requires both that the user enabled developer settings and that they have remote adb enabled. So, this does not seem to be a realistic attack vector for 99.9% of the users and most of the other 0.1% probably know what they are doing. The other proposed change (to restrict access to certain interfaces o…
Isn't this because of the kimwolf (and now 6+ other botnets) that are taking advantage of people running residential proxyware unknowingly on the device which permits outbound connections to 127.0.0.1 on tcp/5555 to auth in and exec wgets or drops a loader that grabs the ddos malware APKs and install it?
That said, I wasn't under the impression kimwolf was that technically sophisticated. Some of the others are, though.
Re: Android may soon restrict on-device ADB
#317The article overlooks security implications from spyware, which is a huge problem not only for financial applications, but personal safety, too [0]. Per FTC, a stalkerware will: geo locate, read call list & record calls, read notifications, texts, & possibly emails, access gallery, camera, & files, and monitor network activity. [1] You could do all of those with "on-device adb" (in some cases, with just the appropria…
> Per FTC, a stalkerware will: geo locate, read call list & record calls, read notifications, texts, & possibly emails, access gallery, camera, & files, and monitor network activity. Like Google Mobile Services on stock Android?
Re: Android may soon restrict on-device ADB
#318Earlier quoted context omitted.
Unfortunately many banks in the UK no longer offer a web portal or physical branches. I'd love to see legislation that mandated a functioning web experience for critical services like this (banking, utilities, etc) - otherwise it will continue to further entrench the current duopoly. (I suppose this is also an instance where I should do a better job of voting with my feet and supporting services that do offer this)
Huh? Why the hell would you use a bank that doesn't offer a web portal or have branches if there are banks that still do?!?! I bank with HSBC in the UK and there's still branches (worldwide) and banking via web. I assume you mean things like Starling and Monzo in this case? Banking with them is simply dangerous .
Re: Android may soon restrict on-device ADB
#319Earlier quoted context omitted.
> In other words: this is all but impossible to impact regular users, and it requires a particularly careless developer to be hit by it. Have you ever worked with someone who barely knows how to use a mobile phone? They will hand their phone over to someone they barely even know to do something they don't understand. They will follow instructions from a stranger over the phone, without understanding what the phone is…
Following this logic, shouldn't we just ban smart phones for everyone then? If we need to dumb down all technology to the absolute lowest level, we should probably ban computers or at least require an official government-controlled license to get access to one. Is this a world you want to live in? Me neither.