1

I'm wondering what security threats I should be aware of if I set up a testing farm (like STF) which will have several Android devices connected to PCs over USB.

  1. The Android devices will have USB debugging enabled and the PC will be able to communicate with the Android device
  2. I plan to run tests using frameworks like Appium but will also use ADB commands directly on connected devices
  3. I will only have trusted devices connected to the PCs (as in I'm certain that the hardware is secure)
  4. However, I may have untrusted apps installed on those trusted devices (random apps downloaded from the Internet that could be malicious)

Is there a possibility here that the untrustworthy apps that may be installed on the Android devices can somehow compromise the PCs (and the network) with the USB connection from the Android device to the PC being the only way they can talk to the PCs?

Improve this question
3
  • 3
    As far as I know the adb server on your PC is the master and adbd on each phone is the client. The master initiates the command but never the client. Therefore, adb should be safe. However a malicious app could use an exploit to gain root permissions and change the USB mode to e.g. emulate an USB keyboard and then send key strokes to the PC.
    – Robert
    Mar 1, 2022 at 12:20
  • @Robert thanks for your comment. Are you aware of any such apps/incidents in the past? I'd love to learn more about this.
    – Vinayak
    Mar 2, 2022 at 11:01
  • 1
    I am not aware of such incidents. Usually the social engineering way is easier than implementing such an attack I outlined. If the phone shows a warning like: "Please connect the phone to a PC, download XYZ and execute it to update your device otherwise it data loss can occur" a lot of users will do so...
    – Robert
    Mar 2, 2022 at 11:12

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .