Hacker News new | past | comments | ask | show | jobs | submit

Android May Soon Restrict On-Device ADB

https://kitsumed.github.io/blog/posts/android-may-soon-restrict-on-device-adb/
I am generally in favor of security improvements, but I do not really see much of a benefit here. This attack vector requires both that the user enabled developer settings and that they have remote adb enabled. So, this does not seem to be a realistic attack vector for 99.9% of the users and most of the other 0.1% probably know what they are doing.

The other proposed change (to restrict access to certain interfaces or IP addresses) seems good, but why not allow developers to restrict access localhost?

It reeks of trying to block Shizuku, Canta, etc. using a way that only makes it look like a side-effect.

> This attack vector requires both that the user enabled developer settings and that they have remote adb enabled.

Not just that. A non-development Android build will also prompt the user when a connection is made to authorize the client's key.

This once again isn't about security of users, this is about security of the company's interests.

loading story #49047334
loading story #49046800
loading story #49047773
Isn't this because of the kimwolf (and now 6+ other botnets) that are taking advantage of people running residential proxyware unknowingly on the device which permits outbound connections to 127.0.0.1 on tcp/5555 to auth in and exec wgets or drops a loader that grabs the ddos malware APKs and install it?
loading story #49046291
loading story #49046406
loading story #49045902
It's not because of security. It's to slowly close any avenues for side-loading stuff
loading story #49047277
The bug literally describes how they're avoiding OS security restictions by going through the debug port.

This is a CVE by any definition and you'd be screaming your head off if any other OS would allow this kind of permission bypass (or even if another app did it).

But sure, Google evil.

loading story #49046052
loading story #49045744
loading story #49045785
loading story #49046188
loading story #49045845
loading story #49045824
loading story #49046017
loading story #49045859
loading story #49045860
Limiting ADB is the obvious next step. Even if this one specific feature request does not come to pass, Google has cornered everyone into relying on a developer interface for any normal personal computing tasks, whether running on-device or through USB/wireless. It's quite clear at some point in the future you will either be required to surrender your identity to them and pay a yearly fee or be severely limited to continue using it in any meaningful capacity, because Google does not want you to develop applications on Android outside their controlled channels -- and it's a developer bridge, the battle was already lost when they did not back down from the changes forbidding normal, legitimate ̶s̶i̶d̶e̶l̶o̶a̶d̶i̶n̶g̶ installation.

>Don’t even get me started on OEMs that force an audio warning such as “This call is being recorded,” when it’s in places where it’s not legally required.

This is also Google's fault. Their dialer--that OEMs increasingly pick over their own, despite their always being much better, see old MIUI one for example--just blanket applies the rule almost everywhere. Especially annoying on all MediaTek SoCs that do not support the feature on an hardware level at all through proper, reliable third-party applications. As if you didn't need any more proof you don't own "your" devices. But maybe in a couple years Gemini will be able to listen to the calls and summarize them for you, just need to go through the approved surveillance channel.

> Spamming the thread will only cause Google developers to lock the issue, ignore valuable community feedback, or stop sharing public updates about this change entirely.

So nothing would change (they can also lock away your "valuable community feedback" because what bothers them is the criticism itself), thus feel free to express your approval

loading story #49046430
The moment an article like this hits HN or Reddit or any other such forum, any hope of changing anyone's mind is lost. The same happens to Github issues too. I haven't checked the isue myself, but seeing it here means it's probably already too late at this point, it'll probably get flooded.

Google does take feedback from app developers every now and then, but obviously their own teams' feelings on the subject are more important to them than some open source developers relying on a hack like in this article.

I think it should be quite obvious that the ADB daemon wasn't designed to enable call recording from an app initiating an adb session over a loopback address. https://xkcd.com/1172/ strikes again.

That doesn't mean the developer who wrote this is wrong to dislike the change: Google themselves have added call recording to their dialer a while ago so it's clearly a feature they stand behind. That doesn't mean the adb team shouldn't do a little security hardening, though.

The implication in the blog post that Google developers somehow “overlooked” or “misunderstood” important use cases here, and if only they were informed about them they would reconsider, is frankly insulting.
Every single time any story has the words "Google developers" in it, they're behaving like arrogant, disconnected, anti-consumer jerks. From constant GCP breakage, to not acknowledging obvious Android bugs, to intentionally braking Chrome. It's a stark contrast to behind the scenes interactions with them.
loading story #49045965
loading story #49045872
loading story #49046679
Of course this was bound to happen, next you're telling me people will be surprised that the 24 hour limit for side loading will turn into some indefinite time period.
It can and will most probably turn to indefinite time depending on the answer to the question "will we have a viable alternative to jump ship before that happens ?".

We don't need anything to completely capture the market, it has to be just enough to make Google hesitate or make it hard for Google to do it for legal reasons. Like how Firefox is ideally supposed to be for Chrome.

loading story #49045608
loading story #49046212
loading story #49050692
This is huge, Android getting locked down to such levels should be sounding alarm bells. They are slowly removing everything that makes Android good.
I am worried that this might happen to websites soon.

If you want your website to be openable on Apple devices, you would have to pay Apple a fee each month. If you want your website to be openable on Android devices, you would have to pay Google a fee ecah month, etc.

loading story #49046306
I am thinking how this would split the web.

You would have the "new web" consisting of the top n major websites paying this fee.

And then you would have the "old web", accessible only to people still owning their own PCs with unrestricted browsers. And probably heavily scrapped by AI companies to reguritate to the masses through the new web.

That's already the case for Netflix and other video streaming services.

You don't have to pay a fee directly, but you can't use open source web browsers.

we can just fork android

edit: I not realizing that I been replying to wrong comment

loading story #49045810
We need Linux on phones. Bank apps not needed as long as I can use browser. But do need some things like wireless cards, popular apps like Sonos and Spotify working.
Unfortunately many banks in the UK no longer offer a web portal or physical branches.

I'd love to see legislation that mandated a functioning web experience for critical services like this (banking, utilities, etc) - otherwise it will continue to further entrench the current duopoly.

(I suppose this is also an instance where I should do a better job of voting with my feet and supporting services that do offer this)

Good news for EU citizens though, PSD3 will require that authentication methods without a smartphone are provided:

https://ec.europa.eu/commission/presscorner/detail/fr/qanda_...

Require payment services providers to ensure that all users can benefit from methods to perform SCA which are adapted to their needs and situations and, in particular, that those methods do not depend on one single technology, device or mechanism, for instance on the possession of a smartphone.

loading story #49047030
loading story #49046641
> many banks in the UK no longer offer a web portal

Same in Norway.

loading story #49046033
loading story #49047392
loading story #49047809
loading story #49048030
loading story #49046883
Unfortunately these days bank apps are required by the banks for "security", and good luck getting anything done without the bank app installed on your phone.

The only other alternative available is SMS but that is being phased out (rightly so) for being insecure.

loading story #49046143
Android is Linux on phones ;)
loading story #49045997
There's only one reason for anyone, or for me, at least, to choose Android, and it's the only reason I've consistently chosen Android from the very first Google Developer Phone: It's more open.

So, they don't want me to even have that one reason to keep choosing Android, I guess.

loading story #49047564
loading story #49050655
loading story #49049557
loading story #49046980
finally my children will be secure and my bank account impenetrable!
loading story #49050482
It's this stuff thats caused me to start degoogling as much as I can. I've started using nongmail emails and removing photos.

I Don't know what else I can do though, next up is switching to grapheneOS but I'm a ways off from that for now.

loading story #49048348
loading story #49047831
Google is going the Apple route. When will we get the year of the Linux Phone?
loading story #49048092
Thank you for telling me about Shizuku! Android world is so vast and full of resources
loading story #49049174
This assumes user is the only person with physical access to unlocked phone.

All sorts of goverment agencies, airport security, even teachers now have access. And such attacks can be trivially automated, so even low paid worker can do it.

This is solvable by adding big huge warning that ADB is running. Not by removing feature.
loading story #49046156
loading story #49045696
What I find most annoying aspect of all software from 2010s onwards is this stupid discourse and associated results:

- some people want A, or A might even be already in use

- A is problematic for $MODERATE_OR_MILD_REASON

- B is introduced and made default

- a config switch between A and B is never considered

So, so tiring. If I want to bind ADB to localhost, _let me_. It's my device and my problem, ffs.

Toxic max security.

Not everyone has the same threat model as you, $BIGTECHCORP.

loading story #49045466
loading story #49045590
loading story #49045468
loading story #49045483
Google doesn't want you to be able to skip YouTube ads. It's as simple as that.
No one's requested the config switch from A to B with a restriction that's acceptable to those seeking B. Idealism doesn't tend to offer compromises, and so Idealism tends to lose when it doesn't make a convincing case to regulators. Here's a simple and easy to implement example compromise that could be offered today:

"Changing between A and B requires a device reset."

Most people are going to flat out refuse to wipe their device for a phisher, especially since it'll log them out of everything and trigger all sorts of "new device on your account" warnings everywhere if it's done without their knowledge.

Sure, this is mildly annoying for the 1% that have good reason for A — but it's annoying once per device rather than losing A for good as is happening now. Sure, Google will deny service to A. They're doing that no matter what, either b/c they remove A or b/c they deny A, but this forces them to construct and defend a case for why users who went through the hassle of wiping their device to switch to A ought to be denied access to the app store, and that's a critically absent case in regulatory circles right now. (See also Graphene vs. the EU age check app.)

That's all it would take to protect B from A, but no one asks for it, and no one presses Google publicly for it, and so of course Google isn't doing it. No megacorp will help you walk off the Golden Path without some sort of extrinsic pressure. I see a great deal of clamor around wanting A, but absolutely none of the 'here's a mild annoyance that we came up with as a valid and safe compromise' clamor that would make them look incompetent in the public eye, provide further leverage for EU antitrust steps regarding Android itself, and give them a way to continue to protect users who need B for safety, while allowing those of us who want A to pursue it.

Perhaps other styles of compromise exist, too? As far as I can determine, no one else is thinking about this in terms of "what compromises will developers offer that continue to protect non-developers?", and so I have no other examples to offer. I'd sure love to see more ideas, more effort invested into offering serious and real compromises rather than inflexible resistance of every real safety improvement.

>a config switch between A and B is never considered

And why should modern corpo maintain additional complexity to pander to 1% of privacy-aware tech-savvy users?

Step back to the other issue (referenced in the page*), that Google would pushing on devices something that blocks applications that do not come from play.google.com . Was it not established that Google can only push that update on devices with a google account?

* https://keepandroidopen.org/

Android had a tradeoff - less vertical integration and more annoyances, a bit worse software quality, for a more open, customisable and utility-like experience. I loved that.

Now, the tradeoff is - less vertical integration, double the integration layer trash (Google & OEM) and a much more locked down experience. But the quality of it hasn't improved, it just got worse.

Doesn't make sense anymore. They can now do 99% of the same things, but iOS has a better quality OS, better apps and better vertical integration.

Not even vertical integration, actually just any kind. FFS it's 2026 and the recommended android way to send a photo to your mac/PC is "upload to google photos and hope it decides to sync".

loading story #49047604
loading story #49048860
loading story #49046748
loading story #49048260
loading story #49049008
loading story #49047360
This is about control, not security. As in, Google's control over your device, your experience, your features and choices. This and Google just isn't interested in supporting an open OS anymore. Maybe they think it makes them liable.

Either way the writing is on the wall, and has been for a while.

Can they ruin it faster i am sick of it already. Need to root the phone to get basic functionality, i need like 6-7 magisk modules to do basic things. I can't access file system on device i paid 250$. I have to use adb to change basic things, i rather use symbian.
loading story #49046397
loading story #49047880
loading story #49046853
I'm so done with Android and iOS. I already carry around 2 phones because neither will give me exactly what I want, maybe it's time for a 3rd running Linux..?
Linux phone is already a thing that exists and is at a point where it can be used by tech illiterate people within the confines of what is possible normally.

It's just that few people bother using it. But that number might increase if Android continues it's war against its users.

loading story #49050107
loading story #49047825
loading story #49047306
Does anyone have any doubt left that we're headed for a future where you need a government ID to use any computing device, and only allowed to do government-approved tasks and view government-approved content?

Not a rhetorical tinfoil question: Does anyone still believe there's some hope for personal freedoms?

loading story #49047909
goodbye shizuku i guess, and maybe termux
loading story #49047055
loading story #49047813
loading story #49047541
loading story #49047716
> Scenario 3: A Developer Using ADB over TCP/IP

- You install a malicious application.

- You enable USB debugging, starting ADBD.

- You connect via USB ADB to enable TCP/IP, then disconnect the USB cable.

- ADBD continues running and listens on all network interfaces.

- The application initiates a connection, causing an authorization prompt to appear on the screen. If the user selects No, the connection is rejected. No silent exploitation attempts are possible.

I understand the author's rationale and think the reasons why that whole ecosystem is accessing ADB are legitimate - but I have some questions here.

The above flow is basically what apps that use Shizuku have to do as well, right? Only that in that case, the user would deliberately install the app and have the knowledge it uses ADB features and therefore would also confirm the permission prompt.

However, ADBD in this situation only sees a connection attempt, not which app made the attempt, right?

So it also cannot remember that a particular app was already authorized by the user and has to display the prompt again on each connection attempt?

Does that mean that a Shizuku-enabled app would prompt the user again for ADB access any time it's started?

This seems honestly like Shizuku itself would increase the risk of a user granting ADB access to a bad actor (i.e. a second app or external connection that is different from the app the user wanted to authorize).

Thinking of "scenario 3" if a Shizuku-enabled app is already running on the device and something else wants to connect to ADB:

- I'm assuming a malicious app was already installed (without privileges) or something tries to connect to port 5555 from outside or via proxyware.

- ADBD is already running and listening for TCP to serve the Shizuku app, so those steps can be taken for granted.

- The malicious app or connection triggers a permission prompt from ADBD. However, by that time, the user has grown used to those prompts, because the Shizuku triggers them frequently, so they are more likely to select "yes".

If ADBD has no information about who is connecting, it also can't show any meaningful information in the prompt. So it cannot really help the user distinguish prompts from the legitimate Shizuku app from malicious prompts. A user still has the timing and context to distinguish prompts, i.e. prompts that appear out of the blue when they aren't using the app are suspicious.

It's frankly amazing how many Google developers will associate their real identities and contact info with such hostility, believing they're invincible.

Perhaps they should be subjected to the full force of the First Amendment.

loading story #49046820
adb connecting a device to itself is just bad design and a hack. Either the capabilities should just be granted directly to the app or it should all be blocked.
Same can be said about loopback device in general. Why do you need to use networking when you are literally on the same device and can use binder/dbus and friends with native apps?

Shizuku uses Binder AFAICS[^1]. Looking deeper it seems that Shizuku does not connect to the device itself per se, but rather it has a privileged server launched manually through adb. Never used Shizuku, so can't say for sure.

[1]: https://github.com/rikkaapps/shizuku#how-does-shizuku-work

bullish on google stock

revenue must go up

These are not accidents. Google declared total war against open source. You only need to remember how it declared war against ublock origin. In the long run this will also fail, but until then Google causes a lot of damage. Legislation needs to control this tyrant but unfortunately the oligarchs run the country of the mad orange king right now.

Louis Rossman will have a field day with Google here. I think it is time to end Evil - that is, to end Google. This company serves no more useful purpose on this planet anymore.

The article overlooks security implications from spyware, which is a huge problem not only for financial applications, but personal safety, too [0].

Per FTC, a stalkerware will: geo locate, read call list & record calls, read notifications, texts, & possibly emails, access gallery, camera, & files, and monitor network activity. [1]

You could do all of those with "on-device adb" (in some cases, with just the appropriate permissions), without root access. Stalkerware & financial fraud enabled merely due to the scale & reach of Android (half of humanity uses it!) and lack of basic security literacy warrants such protective measures, as (Thaler & Sunstein would like to remind us) defaults matter.

With conspiracies abound, we must not lose sight of tech safety and related issues, which almost exclusively affect the most vulnerable & the most disadvantaged.

[0] https://www.techsafety.org/spyware-and-stalkerware-phone-sur...

[1] https://consumer.ftc.gov/articles/stalkerware-what-know

"AI ... please create a very efficient emulator which will take an Android app, and convert it to any other operating system"

Anyone up for the challenge? Or a better solution.

Fuck this bullshit. It's only going to get worse.

loading story #49046438
loading story #49049391
loading story #49047620
loading story #49046517
loading story #49046847
loading story #49047499
that seems pretty reasonable actually
To only use ADB through a WLAN? No, it is not that reasonable
loading story #49045580
To iPhone users, perhaps.
loading story #49045567
loading story #49045583