Live data from Hacker News

Android may soon restrict on-device ADB

kitsumed.github.io

311–320 of 536 posts

Re: Android may soon restrict on-device ADB

#311

Earlier quoted context omitted.

This. I'm a developer, I've published Android apps, & I've still managed to lose access to a device that had dev settings enabled purely because remote adb enablement is a (extremely fiddly) toggle that happened to be off on the device at the time the screen broke. Having these two enabled simultaneously is such a rare case in the wild as to be entirely negligible as a vector.

Sometimes attacks happen from users being instructed to enable settings in order to achieve something regardless of whether you’d expect them to have a reason to use the setting

The solution to social engineering can't be to remove useful features - you can socially engineer people to do literally anything, you can have someone walk to their bank, withdraw cash & fly to you with it with a dating scam: there are literally no boundaries once you get into that area of security. Digitally, you combat that through UX, messaging & education.

Re: Android may soon restrict on-device ADB

#312

Earlier quoted context omitted.

Depends how you define a CVE. If owning and controlling your device is a CVE/bug then sure you need a tight box with anti tempering as well.

Can you provide a reasonable definition where an authentication bypass in ADB doesn't qualify as a vulnerability? Is there a use case for allowing anyone on your network to run adb commands without your approval? There are 3 things which I feel like are being confused here: 1. There was a genuine authentication bypass vulnerability in ADB (bad) 2. Initial proposed change wants to add an option to limit the ADB server…

The act of "allowing“ negates the “without your approval“. You see the failure in the logic here I hope.

Re: Android may soon restrict on-device ADB

#313
post #227

Earlier quoted context omitted.

Sometimes attacks happen from users being instructed to enable settings in order to achieve something regardless of whether you’d expect them to have a reason to use the setting

Sometimes people fall down the stairs in their own homes. That doesn't mean the government should mandate everybody to wear helmets at home does it? A measure needs to be in proportion to the actual risk it seeks to mitigate.

I am not in favour of limiting adb access, but this does beg the question, how many accidents would it take to cause enough overfull ERs to make the requirement of staircase railings a thing, in order to make sure there are doctors to treat other things than broken bones. uh happy Saturday.

Re: Android may soon restrict on-device ADB

#314

Earlier quoted context omitted.

This is all inevitable direction over long period of time What’s worrying is that noone protests about it It doesn’t suprise me that corporations and governments want the laziest, most „protective” laws passed that extend their power. But why noone, absolutely noone puts some kind of resistance to it? Government and citizens are at eternal conflict of interests. It has been this way and it will be this way forever. Y…

The frogs are almost done, and the silicone figurines that used to impost actual frogs and croak how pleasant the water is and how it should always keep getting warmer to keep everyone comfortable, will soon be removed from the pot, their duties fullfilled.

[dead]

Re: Android may soon restrict on-device ADB

#315
post #224

Does anyone have any doubt left that we're headed for a future where you need a government ID to use any computing device, and only allowed to do government-approved tasks and view government-approved content? Not a rhetorical tinfoil question: Does anyone still believe there's some hope for personal freedoms?

> Does anyone still believe there's some hope for personal freedoms? as long as such personal freedoms gives users the ability to skirt the profit motives of companies making these devices, there will always be a force to try restrict it. The internet, as it has been, is quite an anomaly, but inevitably, power that the people have gets usurped one way or another. It's just a matter of time.

> The internet, as it has been, is quite an anomaly

It's not an anomaly, it was the data grabbing infrastructure, and now that enough data is vacuumed in from it to train AI, it is now time to turn this dangerously conductive communication network into a control-only one, by all logic of the process and those who funded it all the way.

Re: Android may soon restrict on-device ADB

#316
post #40

I am generally in favor of security improvements, but I do not really see much of a benefit here. This attack vector requires both that the user enabled developer settings and that they have remote adb enabled. So, this does not seem to be a realistic attack vector for 99.9% of the users and most of the other 0.1% probably know what they are doing. The other proposed change (to restrict access to certain interfaces o…

Isn't this because of the kimwolf (and now 6+ other botnets) that are taking advantage of people running residential proxyware unknowingly on the device which permits outbound connections to 127.0.0.1 on tcp/5555 to auth in and exec wgets or drops a loader that grabs the ddos malware APKs and install it?

There are so many people in my neighborhood here that are actively members of residential proxy networks that it makes me stabby. They don't seem to care.

That said, I wasn't under the impression kimwolf was that technically sophisticated. Some of the others are, though.

Re: Android may soon restrict on-device ADB

#317
post #303

The article overlooks security implications from spyware, which is a huge problem not only for financial applications, but personal safety, too [0]. Per FTC, a stalkerware will: geo locate, read call list & record calls, read notifications, texts, & possibly emails, access gallery, camera, & files, and monitor network activity. [1] You could do all of those with "on-device adb" (in some cases, with just the appropria…

> Per FTC, a stalkerware will: geo locate, read call list & record calls, read notifications, texts, & possibly emails, access gallery, camera, & files, and monitor network activity. Like Google Mobile Services on stock Android?

No.

Re: Android may soon restrict on-device ADB

#318
post #155

Earlier quoted context omitted.

Unfortunately many banks in the UK no longer offer a web portal or physical branches. I'd love to see legislation that mandated a functioning web experience for critical services like this (banking, utilities, etc) - otherwise it will continue to further entrench the current duopoly. (I suppose this is also an instance where I should do a better job of voting with my feet and supporting services that do offer this)

Huh? Why the hell would you use a bank that doesn't offer a web portal or have branches if there are banks that still do?!?! I bank with HSBC in the UK and there's still branches (worldwide) and banking via web. I assume you mean things like Starling and Monzo in this case? Banking with them is simply dangerous .

What's wrong with Starling/Monzo?

Re: Android may soon restrict on-device ADB

#319
post #145

Earlier quoted context omitted.

> In other words: this is all but impossible to impact regular users, and it requires a particularly careless developer to be hit by it. Have you ever worked with someone who barely knows how to use a mobile phone? They will hand their phone over to someone they barely even know to do something they don't understand. They will follow instructions from a stranger over the phone, without understanding what the phone is…

Following this logic, shouldn't we just ban smart phones for everyone then? If we need to dumb down all technology to the absolute lowest level, we should probably ban computers or at least require an official government-controlled license to get access to one. Is this a world you want to live in? Me neither.

On the contrary, we should simply restrict app development to a handful of megacorps (who are all in bed with the government) so they can make more money and the government can get the data it wants. Problem solved!
Post reply on HN