1

If I made a wireless hotspot from my phone and had computers infected with malware connect and use my wireless connection of the phone can any malware from the pc get into the phone?

If my phone was connected to an infected computer by the USB cable the first thing that happens when you connect to the computer is you get asked to allow or deny the computer access to the phone's storage. If I choose "deny" so storage isn't mounted and then use USB tethering for the internet would this be fine, to avoid the phone been infected?

Also would both my questions be at more risk if USB debugging on the phone was turned on? I know it allows the computer to run commands on the phone, I just don't know if USB debugging has risks with wireless hotspot, or if USB debugging can be used by the computer if I choose to deny access to phones internal storage.

3

It perhaps makes more sense if I paraphrase your question:

Can a router be infected by devices connected to it?

Yes, although in such a scenario the router and infected devices will typically have very different configurations and operating systems - implying that an exploit targeting the client device is unlikely to affect the router device. And it would be very unusual (but not completely impossible) for the router to be exploitable via the traffic it routes - more likely by services exposed on the router device for control, configuration or other purposes (such as storage).

If the router is a phone then it will provide additional functionality (such as storage). But it is unlikely to provide the remote configuration functionality one would expect on a dedicated router (having its own user interface and limited number of interfaces).

Using USB tethering rather than Wifi for connectivity changes Some things - by exposing different services on the phone to a (possibly) different set of clients - e.g. it might be impossible to invoke the telephony operations over wifi, but accessible via USB. Hence (except for the case of running an open hotspot) its impossible to say if USB offers any security benefit over wifi or vice versa.

at more risk if usb debugging on the phone was turned on

Yes, you would be at more risk - there's a bigger attack surface.

There will always be a lot more infected devices on the internet side of the "router" than on the local network interface.

  • So it won't matter if a host computer is infected, while connected to my wireless hotspot pretty much. When i connect my phone to computer it's on charging by default, the only way to browse it's storage is if i choose the option to transfer files. The rom i'm using requires usb debugging is turned on for the hotspot or usb tethering to work, i do intend to download from infected websites, if i don't choose transfer files and leave it on charging only while tethered by usb will it be safe with usb debugging on? also would usb tethering be safe if usb debugging was turned off with same premise. – Alister Jul 25 '18 at 6:25
  • Also does usb debugging been turned on or off, have any effect on the wireless hotspot of the phone, been connected to an infected computer? – Alister Jul 25 '18 at 6:26
3

I don't know any vulnerability that an infected computer can attack an android device acting as an hotspot.

Related to the second question, it's possible that it could be fine, but can always exists a vulnerability or 0day to bypass that protection. One example in Android 4.4.2. The best solution for this is to use a "condom", read more in here.

If you don't need USB debugging enabled, it should be disabled. If you don't want to turn it on and off every day, you should use the solution above (usb condom) when connecting to untrusted devices. Be aware that some devices have ADB enabled over the network, that it's a common vulnerability that is being exploited on the wild.

  • That's good to no, yeah i no it should be disabled, but the rom i'm using on my phone requires it to be on for hotspot and usb tethering to function, seen similar with transferring files on some custom roms root access that's scary is this how you disable it? not sure the best way to check it hacktabs.com/enable-disable-adb-wifi-rooted-non-rooted-android if your able to answer what i have responded to @symcbean that would help to for clarification. – Alister Jul 25 '18 at 6:56
  • Also is that root risk only people on the same network as you that pose a threat or anywhere? – Alister Jul 25 '18 at 7:42
  • That is specific for ADB over Wifi. Not sure if disabling USB debugging will also stop ADB to working via Wifi. To disable it, you should go to Developer options and disable USB debugging. Having your device root you need to be extremely careful which application you install on your device. Not sure how being rooter can externally be influence by other users. – David Magalhães Jul 25 '18 at 9:15
  • My custom rom has it in developer options, ADB over network don't have to turn usb debugging off, gives a warning says risks on all networks, including gsm data network, so just using mobile data alone is enough to be effected. Not sure if all venders with it turned on have this in developer settings. Turns off after reboot. I do have root, only open source root apps, xposed modules. – Alister Jul 25 '18 at 11:34
  • You can check if is available using your internal IP (when connecting to a wifi network) or your external IP when connecting to a 3G/4G/etc network using telnet 192.168.1.76 5555 on a command line in your computer. In this case, you need to replace 192.168.1.76 with your internal ou external IP. – David Magalhães Jul 25 '18 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.