Rendered at 10:17:33 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
microtonal 2 hours ago [-]
I am generally in favor of security improvements, but I do not really see much of a benefit here. This attack vector requires both that the user enabled developer settings and that they have remote adb enabled. So, this does not seem to be a realistic attack vector for 99.9% of the users and most of the other 0.1% probably know what they are doing.
The other proposed change (to restrict access to certain interfaces or IP addresses) seems good, but why not allow developers to restrict access localhost?
It reeks of trying to block Shizuku, Canta, etc. using a way that only makes it look like a side-effect.
m132 33 minutes ago [-]
> This attack vector requires both that the user enabled developer settings and that they have remote adb enabled.
Not just that. A non-development Android build will also prompt the user when a connection is made to authorize the client's key.
This once again isn't about security of users, this is about security of the company's interests.
pigggg 2 hours ago [-]
Isn't this because of the kimwolf (and now 6+ other botnets) that are taking advantage of people running residential proxyware unknowingly on the device which permits outbound connections to 127.0.0.1 on tcp/5555 to auth in and exec wgets or drops a loader that grabs the ddos malware APKs and install it?
crote 15 seconds ago [-]
It seems to require the user to:
1. Enable Developer Mode by going to an obscure settings page and tapping the build number seven times
2. Enable USB ADB debugging in the Developer Options
3. Establish an actual USB ADB session
4. Enable TCP/IP ADB debugging in the Developer Options
5. Unknowingly download a malware app from the official Play Store
6. Blindly click "Yes" on the permission prompt.
In other words: this is all but impossible to impact regular users, and it requires a particularly careless developer to be hit by it. And it only works if the Play Store is useless at preventing malware in the first place - but I thought their excellent app scanning was the entire reasoning behind all-but-banning 3rd-party app stores and sideloading???
It is "for safety" in the same sense that governments banning all encryption is to "protect the children" or to "prevent terrorism": flawed justification invented to distract from the real reason they want it.
xg15 1 hours ago [-]
Hadn't thought about that additional attack vector those proxies are enabling. In addition to "internet access from residental connection" privileges, the attacker also gets access to loopback on the device that does the proxying...
But even then, shouldn't this show the same permission prompt for the user that anything else trying to connect to port 5555 would?
londons_explore 14 minutes ago [-]
Yes, but users are told to allow it if they want to get free coins etc.
TeMPOraL 3 minutes ago [-]
You can't fully protect people from the risk of taking bad advice from malicious strangers.
Not the least because most of our industry relies on it to make money. Marketing and advertising themselves are institutionalized forms of "do this thing that's actually harmful to you to get free coins / be safe / get laid".
xg15 1 minutes ago [-]
> Not the least because most of our industry relies on it to make money.
I mean, this seems more like one of the root causes for a lot of bad things in the industry me...
xg15 4 minutes ago [-]
Told by whom though? If it's through proxyware, then there are three parties who mostly don't know each other:
- the app embedding the proxyware SDK for money
- the proxy operators
- the attackers/botnets using the proxy to access ADB.
The botnet has no access to the app, so it can't show any messages.
The app can show messages, but probably has no connection to the botnet. (I hope)
The proxy operators could show a message by abusing the SDK even more, but that would mean they actively colluded with the botnet. Is that likely? (Also, they could just give the botnet direct access to the app then, no need to do the whole proxy thing)
londons_explore 48 seconds ago [-]
[delayed]
PunchyHamster 35 minutes ago [-]
It's not because of security. It's to slowly close any avenues for side-loading stuff
izacus 2 hours ago [-]
The bug literally describes how they're avoiding OS security restictions by going through the debug port.
This is a CVE by any definition and you'd be screaming your head off if any other OS would allow this kind of permission bypass (or even if another app did it).
But sure, Google evil.
gnfargbl 44 minutes ago [-]
You, and may of the people in the thread here are at cross purposes, I think.
Separately, a number of people here are attempting to argue that the availability of On-Device ADB should be regarded as a "CVE" in and of itself. Google does not appear to share that view.
dns_snek 18 minutes ago [-]
> Separately, a number of people here are attempting to argue that the availability of On-Device ADB should be regarded as a "CVE" in and of itself. Google does not appear to share that view.
> This is a CVE by any definition and you'd be screaming your head off if any other OS would allow this kind of permission bypass.
Or perhaps they wouldn't? CVEs aren't holy scripture, and "security" isn't the most important consideration in computing. This theatre has gone too far IMO.
dns_snek 53 minutes ago [-]
Allowing strangers to run adb commands on your phone without your consent is about as bad as a compromise can get. Your keyboard can be replaced with a keylogger and all of your data can be stolen without your knowledge by simply connecting to the wrong wifi network.
TeMPOraL 46 minutes ago [-]
Yes, but what about allowing me to run adb commands on my phone with my consent, and especially delegating that privilege to "strangers", again, with my (one-time) consent - by which I mean authorizing apps to run with elevated privileges and/or reestablish the debugging bridge once it invariably disconnects (for other more or less legitimate security reasons)?
It's not like those threats silently turn on ADB on people's phones without their knowledge. You have to opt in to a rather obscure, hidden by default, and very fickle feature to become potentially vulnerable in the first place.
dns_snek 27 minutes ago [-]
They're 3 separate issues. There's a genuine vulnerability (CVE) which has been fixed, there's a follow-up proposal to allow the user to choose which interfaces to bind to, and there's another proposal to disallow ADB over loopback which would cut you off from using ADB on-device.
Your problem is with the last one which has nothing to do with the CVE itself.
theplumber 1 hours ago [-]
Depends how you define a CVE. If owning and controlling your device is a CVE/bug then sure you need a tight box with anti tempering as well.
dns_snek 1 hours ago [-]
Can you provide a reasonable definition where an authentication bypass in ADB doesn't qualify as a vulnerability? Is there a use case for allowing anyone on your network to run adb commands without your approval?
There are 3 things which I feel like are being confused here:
1. There was a genuine authentication bypass vulnerability in ADB (bad)
2. Initial proposed change wants to add an option to limit the ADB server to certain IPs or network interfaces (good - it doesn't affect you)
3. Response to the original request, proposing that ADB shouldn't be allowed to listen on loopback interfaces (bad/nefarious - it breaks functionality)
"An app can bypass OS security system with certain setting enabled" absolutely fits into CVEs. There's no "depends: on it.
I love how quickly you all forget about security and privacy when it gives a chance to angrily rant.
TeMPOraL 1 hours ago [-]
Anything can fit into CVE.
"An app can bypass OS security system with certain setting enabled" is absolutely a valid CVE. We have countless examples every day of vendor apps bypassing OS security systems because they're allowed to do so.
"A device can bypass protective layers and cause soft tissue damage when thrown" is an absolutely fine CVE, too.
Whether it matters or is something that should be addressed, is the depends part. Here we're talking about CVE that's at risk of trying to address a feature.
You are forgetting the most important questions of security, without which the whole discussion becomes pointless:
Who is securing what, and from who?
CVEs seem much less like holy writ when they're aimed at protecting the device for commercial interests and from the device owner.
rcxdude 1 hours ago [-]
When half that security is aimed against the user it's pretty easy to cheer for cracks in it.
vrighter 55 minutes ago [-]
a lot of cves are of the type "if you leave the keys in the door, then anyone can unlock it and get in! We must destroy all doors, they are insecure!"
This is one of them
dns_snek 3 minutes ago [-]
[delayed]
TeMPOraL 32 minutes ago [-]
You jest, but passkeys seem to have literally been invented to address something like: "Keys to your doors can be used by anyone to open those doors, regardless of your knowledge or presence".
Which is a problem only if the third party acquired those keys without your permission, but the industry decided to "fix it" regardless.
microtonal 22 minutes ago [-]
I am not sure I follow. Are you referring to the original CVE (?), I fully agree that it should be fixed, and it is not what my comment was about.
If you are talking about allowing listening on localhost - remote ADB requires enabling in the developer settings. It is a developer feature, similar to ADB over USB. If I'm charitable, it is possible that they are seeing too many people that are using Shizuku without understanding the security implications. But Shizuku has a lot of useful applications and they use ADB because the Android APIs and permission system are lacking and do not make these applications possible.
roer 1 hours ago [-]
The original issue is proposing letting the user assign the debug service to a specific interface, one of which would presumably be loopback. This article is about the proposal from a developer that it should only ever be assigned to wlan0, which would break a lot of apps.
Letting applications bypass permissions with this feature is the exact usecase they don't want to lose. If anything, I don't see them being against the original proposal possibly restricting non-loopback access, which would enhance security.
izacus 1 hours ago [-]
It would break exactly 0 apps because none of the apps should be using this API to access your private data and phone call audio.
microtonal 12 minutes ago [-]
So why do Google Play Services, etc. have full privileged access to a phone, including private data and phone call audio, but the user doesn't?
It is tech feudalism - you don't own anything anymore, you just get to live on the digital land of a bunch of ~trillion dollar companies.
At least, that is the goal.
IMO either everyone gets access at the user's discretion or Google has to sandbox their own GMS services as well.
TeMPOraL 30 minutes ago [-]
Why? What other APIs should my apps (or the apps I explicitly want to authorize for this purpose) use to access my private data and my phone call audio?
3form 1 hours ago [-]
Because you know, the actual solution would be to have more granularity in authentication process than "allow whole device to attach to ADB", but that would be like, difficult... so they're not going to so that.
Right now any app on my PC connected to ADB could manipulate my phone then, and that's somehow not a CVE?
dminik 1 hours ago [-]
Is it a CVE that an app running on my PC could actually be running under GDB? It's the entire purpose of these tools.
spaqin 51 minutes ago [-]
In this case, the OS security restrictions should be questioned in the first place as excessive if a "backdoor" is necessary for normal function.
zmmmmm 1 hours ago [-]
Even if you have to deliberately enable a setting and enter a pairing code?
It's like saying that the fact the user knows their own password is a vulnerability because they might enter it to log into their account.
mrsssnake 1 hours ago [-]
"...avoiding OS security restictions by going through the debug port..." the user delibretry opened and paired to app with clear visual confirmation in order to use it.
eviks 2 hours ago [-]
> Spamming the thread will only cause Google developers to lock the issue, ignore valuable community feedback, or stop sharing public updates about this change entirely.
So nothing would change (they can also lock away your "valuable community feedback" because what bothers them is the criticism itself), thus feel free to express your approval
jeroenhd 57 minutes ago [-]
The moment an article like this hits HN or Reddit or any other such forum, any hope of changing anyone's mind is lost. The same happens to Github issues too. I haven't checked the isue myself, but seeing it here means it's probably already too late at this point, it'll probably get flooded.
Google does take feedback from app developers every now and then, but obviously their own teams' feelings on the subject are more important to them than some open source developers relying on a hack like in this article.
I think it should be quite obvious that the ADB daemon wasn't designed to enable call recording from an app initiating an adb session over a loopback address. https://xkcd.com/1172/ strikes again.
That doesn't mean the developer who wrote this is wrong to dislike the change: Google themselves have added call recording to their dialer a while ago so it's clearly a feature they stand behind. That doesn't mean the adb team shouldn't do a little security hardening, though.
p-e-w 2 hours ago [-]
The implication in the blog post that Google developers somehow “overlooked” or “misunderstood” important use cases here, and if only they were informed about them they would reconsider, is frankly insulting.
light_hue_1 2 hours ago [-]
Every single time any story has the words "Google developers" in it, they're behaving like arrogant, disconnected, anti-consumer jerks. From constant GCP breakage, to not acknowledging obvious Android bugs, to intentionally braking Chrome. It's a stark contrast to behind the scenes interactions with them.
lII1lIlI11ll 58 minutes ago [-]
Yeah, my favorite one is how Chrome users are not smart enough to handle case-aware web-page search toggle. Although to be fair their Chrome team is very arrogant even by Google standards.
izacus 1 hours ago [-]
Yeah, fixing severe security issues that allow apps to bypass security, how arrogant of them.
TeMPOraL 23 minutes ago [-]
You forgot to ask yourself whose interests are being secured, and who/what is the threat being secured from.
Security is not an unqualified good. It's just mechanism of control.
lII1lIlI11ll 1 hours ago [-]
You keep spamming variations of this comment without explaining how could apps actually bypass security without several steps that the user needs to take in order for it to work. Are you just farming down votes for some weird reason or will you finally get to the technical details instead of one-sentence snarks?
userbinator 59 minutes ago [-]
I'm sure Google considers users having freedom to be a "severe security issue." /s
satvikpendem 2 hours ago [-]
Of course this was bound to happen, next you're telling me people will be surprised that the 24 hour limit for side loading will turn into some indefinite time period.
devsda 2 hours ago [-]
It can and will most probably turn to indefinite time depending on the answer to the question "will we have a viable alternative to jump ship before that happens ?".
We don't need anything to completely capture the market, it has to be just enough to make Google hesitate or make it hard for Google to do it for legal reasons. Like how Firefox is ideally supposed to be for Chrome.
microtonal 2 hours ago [-]
Many alternative AOSP-based systems work fine today and do not have the new Android Developer Verifier (wow, already rolled out to 500M+ devices [1], though still dormant).
To be honest, it is quite scary that Google is able to remotely roll out an app like that to all GMS Android phones. Of course, we all knew that, but it highlights again that Google can remotely take away functionality that you had before, brick your phone, etc.
We used to call programs like this, that allow someone to remotely break your system, a Trojan horse...
bpavuk 1 hours ago [-]
and now people install Remote Access Trojans just to let GPT and Claude think and work for them, granting them shell and a11y access. really? after seeing that, nothing surprises me
izacus 2 hours ago [-]
Wait till you hear that your OEM can remotely rollout full OS updates with full access to all your data and drivers... carrying Google software and most of it Google code.
atif089 16 minutes ago [-]
Google is working on a new recaptcha strategy to counter that. Essentially any non Google flavor of Android OS will fail recaptcha validation
smolder 2 hours ago [-]
[flagged]
IvanK_net 2 hours ago [-]
I am worried that this might happen to websites soon.
If you want your website to be openable on Apple devices, you would have to pay Apple a fee each month. If you want your website to be openable on Android devices, you would have to pay Google a fee ecah month, etc.
avian 1 hours ago [-]
I am thinking how this would split the web.
You would have the "new web" consisting of the top n major websites paying this fee.
And then you would have the "old web", accessible only to people still owning their own PCs with unrestricted browsers. And probably heavily scrapped by AI companies to reguritate to the masses through the new web.
IshKebab 17 minutes ago [-]
That's already the case for Netflix and other video streaming services.
You don't have to pay a fee directly, but you can't use open source web browsers.
tonyhart7 2 hours ago [-]
we can just fork android
edit: I not realizing that I been replying to wrong comment
rcMgD2BwE72F 1 hours ago [-]
Ah yes, Android without the Play Store.
So you won't be able to use your banking apps, your local transport app, public services apps, health services apps, etc.
But sure, you can do SMS (no RCS though), use the device calculator, and maybe browse the Web… until websites kick you out because your non Chrome/Safari browser isn't supported anymore. Even Signal won't work well due to the lack of FCM.
And I'm a GrapheneOS user happy with Obtainium and without Play Services installed in main user space.
BoxwoodSeed 36 minutes ago [-]
I always disable everything Google that comes preinstalled other than maps, including the App store. You can download stuff that you can only get there through Aurora, but really most of what I use comes from F-Droid.
Not that I trust a device running Android enough to do banking, mind you.
tonyhart7 1 hours ago [-]
the situation is not ideal but this is the best we can do
peheje 2 hours ago [-]
We need Linux on phones. Bank apps not needed as long as I can use browser. But do need some things like wireless cards, popular apps like Sonos and Spotify working.
mnahkies 1 hours ago [-]
Unfortunately many banks in the UK no longer offer a web portal or physical branches.
I'd love to see legislation that mandated a functioning web experience for critical services like this (banking, utilities, etc) - otherwise it will continue to further entrench the current duopoly.
(I suppose this is also an instance where I should do a better job of voting with my feet and supporting services that do offer this)
ninalanyon 1 hours ago [-]
> many banks in the UK no longer offer a web portal
Same in Norway.
cynicalsecurity 49 minutes ago [-]
Poland, all banks I know offer web portal. Linux, Firefox - works perfectly.
Unfortunately these days bank apps are required by the banks for "security", and good luck getting anything done without the bank app installed on your phone.
The only other alternative available is SMS but that is being phased out (rightly so) for being insecure.
BoxwoodSeed 29 minutes ago [-]
Currently my bank requires a device where I need to insert my card to get a one time six digit code based on a QR code the banking website serves me that the device scans.
I'm not quite sure why they don't support something like a yubikey with FIDO, but maybe there's a good reason.
N_Lens 1 hours ago [-]
Android is Linux on phones ;)
nixass 53 minutes ago [-]
And MacOS is Unix on Macs?
luqtas 3 hours ago [-]
finally my children will be secure and my bank account impenetrable!
This assumes user is the only person with physical access to unlocked phone.
All sorts of goverment agencies, airport security, even teachers now have access. And such attacks can be trivially automated, so even low paid worker can do it.
SXX 2 hours ago [-]
This is solvable by adding big huge warning that ADB is running. Not by removing feature.
xg15 28 minutes ago [-]
That huge warning would also be permanently shown for everyone using Shinzuku apps. I think that UX would neither be desirable nor increase security.
throw9394999 2 hours ago [-]
Just use opensource phone os!
tonyhart7 1 hours ago [-]
android is open source
gitowiec 1 hours ago [-]
Thank you for telling me about Shizuku! Android world is so vast and full of resources
mdp2021 2 hours ago [-]
Step back to the other issue (referenced in the page*), that Google would pushing on devices something that blocks applications that do not come from play.google.com . Was it not established that Google can only push that update on devices with a google account?
Android had a tradeoff - less vertical integration and more annoyances, a bit worse software quality, for a more open, customisable and utility-like experience. I loved that.
Now, the tradeoff is - less vertical integration, double the integration layer trash (Google & OEM) and a much more locked down experience. But the quality of it hasn't improved, it just got worse.
Doesn't make sense anymore. They can now do 99% of the same things, but iOS has a better quality OS, better apps and better vertical integration.
Not even vertical integration, actually just any kind. FFS it's 2026 and the recommended android way to send a photo to your mac/PC is "upload to google photos and hope it decides to sync".
OsrsNeedsf2P 1 hours ago [-]
I'm so done with Android and iOS. I already carry around 2 phones because neither will give me exactly what I want, maybe it's time for a 3rd running Linux..?
BoxwoodSeed 22 minutes ago [-]
Linux phone is already a thing that exists and is at a point where it can be used by tech illiterate people within the confines of what is possible normally.
It's just that few people bother using it. But that number might increase if Android continues it's war against its users.
3form 3 hours ago [-]
What I find most annoying aspect of all software from 2010s onwards is this stupid discourse and associated results:
- some people want A, or A might even be already in use
- A is problematic for $MODERATE_OR_MILD_REASON
- B is introduced and made default
- a config switch between A and B is never considered
So, so tiring. If I want to bind ADB to localhost, _let me_. It's my device and my problem, ffs.
Arbortheus 3 hours ago [-]
Toxic max security.
Not everyone has the same threat model as you, $BIGTECHCORP.
rightbyte 2 hours ago [-]
Isn't security just an excuse to push user hostile features?
Like, if security was a concern we would have simpler systems and still use 2fa devices for banks etc.
SXX 2 hours ago [-]
Sometimes it's truly useful featutes, but having no toggle in settings making it terrible.
Like iPhone idle auto-reboot every 3 days. After a while they added "Allow Idle Reboot" flag but it only accessible via MDM and require device wipe and for switching it to be a managed device.
TeMPOraL 1 hours ago [-]
What would that be useful for anyway? Sounds like something aimed to prevent people from reusing their old/secondary devices for IoT.
RobotToaster 1 hours ago [-]
Hides memory leaks
TeMPOraL 1 hours ago [-]
Right, that too. But that's a reason to recommend regular reboots[0], not to force them, and "3 days of inactivity" is a suspiciously specific time that I also saw mentioned in Android settings somewhere the other day.
--
[0] - Which I find deeply ironic, in that merely a decade ago, people would laugh at Windows with its "reboot after installs, reboot in case of problems" approach, and now frequent reboots are seen as Standard Security and Stability Practice on *nix systems, both mobile and server-bound...
SXX 2 hours ago [-]
They dont care about security; only about control.
There are hundreds of millions of outdated Android devices that all Google attestation systems consider secure even though they all running Linux kernel that was never ever updated and can be rooted by anything.
Now try to install your own firmware on them without said outdated kernel... How dare you.
jorvi 1 hours ago [-]
Technically the security works, just for their threat model. An exploit would need root and root means you likely cannot pass attestation AFAIK. The fact that this same exploiter can download all your contacts photos and texts is immaterial to, say, Disney, who want attestation only to prevent ripping of their content.
pjmlp 2 hours ago [-]
Ask Jeeves toolbar disagrees.
einpoklum 2 hours ago [-]
It's not even "max security". We are talking about those big tech corps which are infamous for sharing all of your private information with the government, and analyzing it so as to manipulate you in to buying things, and possibly for other obscure commercial purpuses.
stavros 2 hours ago [-]
Google doesn't want you to be able to skip YouTube ads. It's as simple as that.
altairprime 2 hours ago [-]
No one's requested the config switch from A to B with a restriction that's acceptable to those seeking B. Idealism doesn't tend to offer compromises, and so Idealism tends to lose when it doesn't make a convincing case to regulators. Here's a simple and easy to implement example compromise that could be offered today:
"Changing between A and B requires a device reset."
Most people are going to flat out refuse to wipe their device for a phisher, especially since it'll log them out of everything and trigger all sorts of "new device on your account" warnings everywhere if it's done without their knowledge.
Sure, this is mildly annoying for the 1% that have good reason for A — but it's annoying once per device rather than losing A for good as is happening now. Sure, Google will deny service to A. They're doing that no matter what, either b/c they remove A or b/c they deny A, but this forces them to construct and defend a case for why users who went through the hassle of wiping their device to switch to A ought to be denied access to the app store, and that's a critically absent case in regulatory circles right now. (See also Graphene vs. the EU age check app.)
That's all it would take to protect B from A, but no one asks for it, and no one presses Google publicly for it, and so of course Google isn't doing it. No megacorp will help you walk off the Golden Path without some sort of extrinsic pressure. I see a great deal of clamor around wanting A, but absolutely none of the 'here's a mild annoyance that we came up with as a valid and safe compromise' clamor that would make them look incompetent in the public eye, provide further leverage for EU antitrust steps regarding Android itself, and give them a way to continue to protect users who need B for safety, while allowing those of us who want A to pursue it.
Perhaps other styles of compromise exist, too? As far as I can determine, no one else is thinking about this in terms of "what compromises will developers offer that continue to protect non-developers?", and so I have no other examples to offer. I'd sure love to see more ideas, more effort invested into offering serious and real compromises rather than inflexible resistance of every real safety improvement.
ducktective 2 hours ago [-]
>a config switch between A and B is never considered
And why should modern corpo maintain additional complexity to pander to 1% of privacy-aware tech-savvy users?
magic_hamster 2 hours ago [-]
This is about control, not security. As in, Google's control over your device, your experience, your features and choices. This and Google just isn't interested in supporting an open OS anymore. Maybe they think it makes them liable.
Either way the writing is on the wall, and has been for a while.
Razengan 55 minutes ago [-]
Does anyone have any doubt left that we're headed for a future where you need a government ID to use any computing device, and only allowed to do government-approved tasks and view government-approved content?
Not a rhetorical tinfoil question: Does anyone still believe there's some hope for personal freedoms?
NSPG911 2 hours ago [-]
goodbye shizuku i guess, and maybe termux
xg15 38 minutes ago [-]
> Scenario 3: A Developer Using ADB over TCP/IP
- You install a malicious application.
- You enable USB debugging, starting ADBD.
- You connect via USB ADB to enable TCP/IP, then disconnect the USB cable.
- ADBD continues running and listens on all network interfaces.
- The application initiates a connection, causing an authorization prompt to appear on the screen. If the user selects No, the connection is rejected. No silent exploitation attempts are possible.
I understand the author's rationale and think the reasons why that whole ecosystem is accessing ADB are legitimate - but I have some questions here.
The above flow is basically what apps that use Shizuku have to do as well, right? Only that in that case, the user would deliberately install the app and have the knowledge it uses ADB features and therefore would also confirm the permission prompt.
However, ADBD in this situation only sees a connection attempt, not which app made the attempt, right?
So it also cannot remember that a particular app was already authorized by the user and has to display the prompt again on each connection attempt?
Does that mean that a Shizuku-enabled app would prompt the user again for ADB access any time it's started?
This seems honestly like Shizuku itself would increase the risk of a user granting ADB access to a bad actor (i.e. a second app or external connection that is different from the app the user wanted to authorize).
Thinking of "scenario 3" if a Shizuku-enabled app is already running on the device and something else wants to connect to ADB:
- I'm assuming a malicious app was already installed (without privileges) or something tries to connect to port 5555 from outside or via proxyware.
- ADBD is already running and listening for TCP to serve the Shizuku app, so those steps can be taken for granted.
- The malicious app or connection triggers a permission prompt from ADBD. However, by that time, the user has grown used to those prompts, because the Shizuku triggers them frequently, so they are more likely to select "yes".
If ADBD has no information about who is connecting, it also can't show any meaningful information in the prompt. So it cannot really help the user distinguish prompts from the legitimate Shizuku app from malicious prompts. A user still has the timing and context to distinguish prompts, i.e. prompts that appear out of the blue when they aren't using the app are suspicious.
smolder 2 hours ago [-]
RIP phones
userbinator 1 hours ago [-]
It's frankly amazing how many Google developers will associate their real identities and contact info with such hostility, believing they're invincible.
Perhaps they should be subjected to the full force of the First Amendment.
charcircuit 2 hours ago [-]
adb connecting a device to itself is just bad design and a hack. Either the capabilities should just be granted directly to the app or it should all be blocked.
qrobit 2 hours ago [-]
Same can be said about loopback device in general. Why do you need to use networking when you are literally on the same device and can use binder/dbus and friends with native apps?
Shizuku uses Binder AFAICS[^1]. Looking deeper it seems that Shizuku does not connect to the device itself per se, but rather it has a privileged server launched manually through adb. Never used Shizuku, so can't say for sure.
The article overlooks security implications from spyware, which is a huge problem not only for financial applications, but personal safety, too [0].
Per FTC, a stalkerware will: geo locate, read call list & record calls, read notifications, texts, & possibly emails, access gallery, camera, & files, and monitor network activity. [1]
You could do all of those with "on-device adb" (in some cases, with just the appropriate permissions), without root access. Stalkerware & financial fraud enabled merely due to the scale & reach of Android (half of humanity uses it!) and lack of basic security literacy warrants such protective measures, as (Thaler & Sunstein would like to remind us) defaults matter.
With conspiracies abound, we must not lose sight of tech safety and related issues, which almost exclusively affect the most vulnerable & the most disadvantaged.
To only use ADB through a WLAN? No, it is not that reasonable
throawayonthe 2 hours ago [-]
or over USB, from another device? this is about maybe restricting the wireless variant to only work on wlan0
amelius 2 hours ago [-]
To iPhone users, perhaps.
kasabali 2 hours ago [-]
I'm afraid in a few years iOS will actually (not as a joke) be the more open and customizable option
hagbard_c 2 hours ago [-]
That seems rather unlikely given the the ways of the fruit factory. They don't stand to gain anything from loosening their stranglehold on their flock while they could lose substantially if someone were to open the gate and let the sheep escape. Nope, keeping them penned in is the best way to reliably fleece them.
The other proposed change (to restrict access to certain interfaces or IP addresses) seems good, but why not allow developers to restrict access localhost?
It reeks of trying to block Shizuku, Canta, etc. using a way that only makes it look like a side-effect.
Not just that. A non-development Android build will also prompt the user when a connection is made to authorize the client's key.
This once again isn't about security of users, this is about security of the company's interests.
1. Enable Developer Mode by going to an obscure settings page and tapping the build number seven times
2. Enable USB ADB debugging in the Developer Options
3. Establish an actual USB ADB session
4. Enable TCP/IP ADB debugging in the Developer Options
5. Unknowingly download a malware app from the official Play Store
6. Blindly click "Yes" on the permission prompt.
In other words: this is all but impossible to impact regular users, and it requires a particularly careless developer to be hit by it. And it only works if the Play Store is useless at preventing malware in the first place - but I thought their excellent app scanning was the entire reasoning behind all-but-banning 3rd-party app stores and sideloading???
It is "for safety" in the same sense that governments banning all encryption is to "protect the children" or to "prevent terrorism": flawed justification invented to distract from the real reason they want it.
But even then, shouldn't this show the same permission prompt for the user that anything else trying to connect to port 5555 would?
Not the least because most of our industry relies on it to make money. Marketing and advertising themselves are institutionalized forms of "do this thing that's actually harmful to you to get free coins / be safe / get laid".
I mean, this seems more like one of the root causes for a lot of bad things in the industry me...
- the app embedding the proxyware SDK for money
- the proxy operators
- the attackers/botnets using the proxy to access ADB.
The botnet has no access to the app, so it can't show any messages.
The app can show messages, but probably has no connection to the botnet. (I hope)
The proxy operators could show a message by abusing the SDK even more, but that would mean they actively colluded with the botnet. Is that likely? (Also, they could just give the botnet direct access to the app then, no need to do the whole proxy thing)
This is a CVE by any definition and you'd be screaming your head off if any other OS would allow this kind of permission bypass (or even if another app did it).
But sure, Google evil.
The CVE mentioned in the article is https://nvd.nist.gov/vuln/detail/CVE-2026-0073. That's a real CVE: logic error leading to auth bypass. Fix can be seen at https://android.googlesource.com/platform/packages/modules/a....
Separately, a number of people here are attempting to argue that the availability of On-Device ADB should be regarded as a "CVE" in and of itself. Google does not appear to share that view.
This was proposed by a Google employee: https://issuetracker.google.com/issues/526109803#comment3
Or perhaps they wouldn't? CVEs aren't holy scripture, and "security" isn't the most important consideration in computing. This theatre has gone too far IMO.
It's not like those threats silently turn on ADB on people's phones without their knowledge. You have to opt in to a rather obscure, hidden by default, and very fickle feature to become potentially vulnerable in the first place.
Your problem is with the last one which has nothing to do with the CVE itself.
There are 3 things which I feel like are being confused here:
1. There was a genuine authentication bypass vulnerability in ADB (bad)
2. Initial proposed change wants to add an option to limit the ADB server to certain IPs or network interfaces (good - it doesn't affect you)
3. Response to the original request, proposing that ADB shouldn't be allowed to listen on loopback interfaces (bad/nefarious - it breaks functionality)
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-0073
[2] https://issuetracker.google.com/issues/526109803#comment1
[3] https://issuetracker.google.com/issues/526109803#comment3
I love how quickly you all forget about security and privacy when it gives a chance to angrily rant.
"An app can bypass OS security system with certain setting enabled" is absolutely a valid CVE. We have countless examples every day of vendor apps bypassing OS security systems because they're allowed to do so.
"A device can bypass protective layers and cause soft tissue damage when thrown" is an absolutely fine CVE, too.
Whether it matters or is something that should be addressed, is the depends part. Here we're talking about CVE that's at risk of trying to address a feature.
You are forgetting the most important questions of security, without which the whole discussion becomes pointless:
Who is securing what, and from who?
CVEs seem much less like holy writ when they're aimed at protecting the device for commercial interests and from the device owner.
This is one of them
Which is a problem only if the third party acquired those keys without your permission, but the industry decided to "fix it" regardless.
If you are talking about allowing listening on localhost - remote ADB requires enabling in the developer settings. It is a developer feature, similar to ADB over USB. If I'm charitable, it is possible that they are seeing too many people that are using Shizuku without understanding the security implications. But Shizuku has a lot of useful applications and they use ADB because the Android APIs and permission system are lacking and do not make these applications possible.
Letting applications bypass permissions with this feature is the exact usecase they don't want to lose. If anything, I don't see them being against the original proposal possibly restricting non-loopback access, which would enhance security.
It is tech feudalism - you don't own anything anymore, you just get to live on the digital land of a bunch of ~trillion dollar companies.
At least, that is the goal.
IMO either everyone gets access at the user's discretion or Google has to sandbox their own GMS services as well.
Right now any app on my PC connected to ADB could manipulate my phone then, and that's somehow not a CVE?
It's like saying that the fact the user knows their own password is a vulnerability because they might enter it to log into their account.
So nothing would change (they can also lock away your "valuable community feedback" because what bothers them is the criticism itself), thus feel free to express your approval
Google does take feedback from app developers every now and then, but obviously their own teams' feelings on the subject are more important to them than some open source developers relying on a hack like in this article.
I think it should be quite obvious that the ADB daemon wasn't designed to enable call recording from an app initiating an adb session over a loopback address. https://xkcd.com/1172/ strikes again.
That doesn't mean the developer who wrote this is wrong to dislike the change: Google themselves have added call recording to their dialer a while ago so it's clearly a feature they stand behind. That doesn't mean the adb team shouldn't do a little security hardening, though.
Security is not an unqualified good. It's just mechanism of control.
We don't need anything to completely capture the market, it has to be just enough to make Google hesitate or make it hard for Google to do it for legal reasons. Like how Firefox is ideally supposed to be for Chrome.
To be honest, it is quite scary that Google is able to remotely roll out an app like that to all GMS Android phones. Of course, we all knew that, but it highlights again that Google can remotely take away functionality that you had before, brick your phone, etc.
[1] https://play.google.com/store/apps/details?id=com.google.and...
If you want your website to be openable on Apple devices, you would have to pay Apple a fee each month. If you want your website to be openable on Android devices, you would have to pay Google a fee ecah month, etc.
You would have the "new web" consisting of the top n major websites paying this fee.
And then you would have the "old web", accessible only to people still owning their own PCs with unrestricted browsers. And probably heavily scrapped by AI companies to reguritate to the masses through the new web.
You don't have to pay a fee directly, but you can't use open source web browsers.
edit: I not realizing that I been replying to wrong comment
So you won't be able to use your banking apps, your local transport app, public services apps, health services apps, etc.
But sure, you can do SMS (no RCS though), use the device calculator, and maybe browse the Web… until websites kick you out because your non Chrome/Safari browser isn't supported anymore. Even Signal won't work well due to the lack of FCM.
And I'm a GrapheneOS user happy with Obtainium and without Play Services installed in main user space.
Not that I trust a device running Android enough to do banking, mind you.
I'd love to see legislation that mandated a functioning web experience for critical services like this (banking, utilities, etc) - otherwise it will continue to further entrench the current duopoly.
(I suppose this is also an instance where I should do a better job of voting with my feet and supporting services that do offer this)
Same in Norway.
The only other alternative available is SMS but that is being phased out (rightly so) for being insecure.
I'm not quite sure why they don't support something like a yubikey with FIDO, but maybe there's a good reason.
In case it is made private.
All sorts of goverment agencies, airport security, even teachers now have access. And such attacks can be trivially automated, so even low paid worker can do it.
* https://keepandroidopen.org/
Now, the tradeoff is - less vertical integration, double the integration layer trash (Google & OEM) and a much more locked down experience. But the quality of it hasn't improved, it just got worse.
Doesn't make sense anymore. They can now do 99% of the same things, but iOS has a better quality OS, better apps and better vertical integration.
Not even vertical integration, actually just any kind. FFS it's 2026 and the recommended android way to send a photo to your mac/PC is "upload to google photos and hope it decides to sync".
It's just that few people bother using it. But that number might increase if Android continues it's war against its users.
- some people want A, or A might even be already in use
- A is problematic for $MODERATE_OR_MILD_REASON
- B is introduced and made default
- a config switch between A and B is never considered
So, so tiring. If I want to bind ADB to localhost, _let me_. It's my device and my problem, ffs.
Not everyone has the same threat model as you, $BIGTECHCORP.
Like, if security was a concern we would have simpler systems and still use 2fa devices for banks etc.
Like iPhone idle auto-reboot every 3 days. After a while they added "Allow Idle Reboot" flag but it only accessible via MDM and require device wipe and for switching it to be a managed device.
--
[0] - Which I find deeply ironic, in that merely a decade ago, people would laugh at Windows with its "reboot after installs, reboot in case of problems" approach, and now frequent reboots are seen as Standard Security and Stability Practice on *nix systems, both mobile and server-bound...
There are hundreds of millions of outdated Android devices that all Google attestation systems consider secure even though they all running Linux kernel that was never ever updated and can be rooted by anything.
Now try to install your own firmware on them without said outdated kernel... How dare you.
"Changing between A and B requires a device reset."
Most people are going to flat out refuse to wipe their device for a phisher, especially since it'll log them out of everything and trigger all sorts of "new device on your account" warnings everywhere if it's done without their knowledge.
Sure, this is mildly annoying for the 1% that have good reason for A — but it's annoying once per device rather than losing A for good as is happening now. Sure, Google will deny service to A. They're doing that no matter what, either b/c they remove A or b/c they deny A, but this forces them to construct and defend a case for why users who went through the hassle of wiping their device to switch to A ought to be denied access to the app store, and that's a critically absent case in regulatory circles right now. (See also Graphene vs. the EU age check app.)
That's all it would take to protect B from A, but no one asks for it, and no one presses Google publicly for it, and so of course Google isn't doing it. No megacorp will help you walk off the Golden Path without some sort of extrinsic pressure. I see a great deal of clamor around wanting A, but absolutely none of the 'here's a mild annoyance that we came up with as a valid and safe compromise' clamor that would make them look incompetent in the public eye, provide further leverage for EU antitrust steps regarding Android itself, and give them a way to continue to protect users who need B for safety, while allowing those of us who want A to pursue it.
Perhaps other styles of compromise exist, too? As far as I can determine, no one else is thinking about this in terms of "what compromises will developers offer that continue to protect non-developers?", and so I have no other examples to offer. I'd sure love to see more ideas, more effort invested into offering serious and real compromises rather than inflexible resistance of every real safety improvement.
And why should modern corpo maintain additional complexity to pander to 1% of privacy-aware tech-savvy users?
Either way the writing is on the wall, and has been for a while.
Not a rhetorical tinfoil question: Does anyone still believe there's some hope for personal freedoms?
- You install a malicious application.
- You enable USB debugging, starting ADBD.
- You connect via USB ADB to enable TCP/IP, then disconnect the USB cable.
- ADBD continues running and listens on all network interfaces.
- The application initiates a connection, causing an authorization prompt to appear on the screen. If the user selects No, the connection is rejected. No silent exploitation attempts are possible.
I understand the author's rationale and think the reasons why that whole ecosystem is accessing ADB are legitimate - but I have some questions here.
The above flow is basically what apps that use Shizuku have to do as well, right? Only that in that case, the user would deliberately install the app and have the knowledge it uses ADB features and therefore would also confirm the permission prompt.
However, ADBD in this situation only sees a connection attempt, not which app made the attempt, right?
So it also cannot remember that a particular app was already authorized by the user and has to display the prompt again on each connection attempt?
Does that mean that a Shizuku-enabled app would prompt the user again for ADB access any time it's started?
This seems honestly like Shizuku itself would increase the risk of a user granting ADB access to a bad actor (i.e. a second app or external connection that is different from the app the user wanted to authorize).
Thinking of "scenario 3" if a Shizuku-enabled app is already running on the device and something else wants to connect to ADB:
- I'm assuming a malicious app was already installed (without privileges) or something tries to connect to port 5555 from outside or via proxyware.
- ADBD is already running and listening for TCP to serve the Shizuku app, so those steps can be taken for granted.
- The malicious app or connection triggers a permission prompt from ADBD. However, by that time, the user has grown used to those prompts, because the Shizuku triggers them frequently, so they are more likely to select "yes".
If ADBD has no information about who is connecting, it also can't show any meaningful information in the prompt. So it cannot really help the user distinguish prompts from the legitimate Shizuku app from malicious prompts. A user still has the timing and context to distinguish prompts, i.e. prompts that appear out of the blue when they aren't using the app are suspicious.
Perhaps they should be subjected to the full force of the First Amendment.
Shizuku uses Binder AFAICS[^1]. Looking deeper it seems that Shizuku does not connect to the device itself per se, but rather it has a privileged server launched manually through adb. Never used Shizuku, so can't say for sure.
[1]: https://github.com/rikkaapps/shizuku#how-does-shizuku-work
Per FTC, a stalkerware will: geo locate, read call list & record calls, read notifications, texts, & possibly emails, access gallery, camera, & files, and monitor network activity. [1]
You could do all of those with "on-device adb" (in some cases, with just the appropriate permissions), without root access. Stalkerware & financial fraud enabled merely due to the scale & reach of Android (half of humanity uses it!) and lack of basic security literacy warrants such protective measures, as (Thaler & Sunstein would like to remind us) defaults matter.
With conspiracies abound, we must not lose sight of tech safety and related issues, which almost exclusively affect the most vulnerable & the most disadvantaged.
[0] https://www.techsafety.org/spyware-and-stalkerware-phone-sur...
[1] https://consumer.ftc.gov/articles/stalkerware-what-know
revenue must go up