![](bg6.png)
has been demonstrated — for the three specific sce-
narios — that whenever USB debugging is available,
the device is potentially compromised. In the tested
versions of the OS, the only way to prevent attacks
is to never make USB Debugging available. Once
given this access door, the entire device can be com-
promised in seconds and in a form that is completely
invisible to the victim.
In the specific model Samsung Galaxy Mini GT-
S5570 with the version 2.2 Froyo there is still a pe-
culiarity: the USB Debugging can be available, but in
”not active” state, which allows a false illusion to the
user to be protected when in fact it is not.
It has also been found that even the presence of
protection software, such as the anti-virus, does not
prevent the installation process of a potentially mali-
cious application, at it only warns that a certain appli-
cation may be harmful.
As future work new attack scenarios will be inves-
tigated, namely for newer versions of Android, over-
coming the need for ADB pairing. It would also be
interesting to have a social experience counting how
many devices are be attacked by hour, day or even
week, in places where it was offered the possibility to
charge the devices’ batteries for free. Different places
in different environments would allow the identifica-
tion of cases where more people are most likely to be
victims.
ACKNOWLEDGEMENTS
This work was partially financed by Portuguese
Agency FCT Fundac¸
˜
ao para a Ci
ˆ
encia e Tecnologia,
in the framework of project UID/EEA/00066/2013.
REFERENCES
Android Open Source project (2017). Android de-
bug bridge. https://developer.android.com/studio/
command-line/adb.html [Online; accessed 07-June-
2017].
arsTechnica (2016). 10 million android phones
infected by all-powerful auto-rooting apps.
https://arstechnica.com/security/2016/07/virulent-
auto-rooting-malware-takes-control-of-10-million-
android-devices/ [Online; accessed 07-June-2017].
BusinessofApps (2015). 80% of android phone
owners in china have rooted their device.
http://www.businessofapps.com/80-android-phone-
owners-china-rooted-device/ [Online; accessed
07-June-2017].
Do, Q., Martini, B., and Choo, K.-K. R. (2015). Exfiltrating
data from android devices. Comput. Secur., 48(C):74–
91.
Google (2017). android. http://www.android.com [Online;
accessed 07-June-2017].
Hacks, G. (2015). How to enable developer options & usb
debugging. https://android.gadgethacks.com/how-
to/android-basics-enable-developer-options-usb-
debugging-0161948 [Online; accessed 07-June-
2017].
Hak5 (2012). Android hacking with the USB rub-
ber ducky. https://www.hak5.org/episodes/hak5-1216
[Online; accessed 07-June-2017].
Neugschwandtner, M., Beitler, A., and Kurmus, A. (2016).
A transparent defense against USB eavesdropping at-
tacks. In Proceedings of the 9th European Workshop
on System Security, EuroSec ’16, pages 6:1–6:6, New
York, NY, USA. ACM.
Pereira, A., Correia, M., and Brand
˜
ao, P. (2014). USB con-
nection vulnerabilities on android smartphones: De-
fault and vendors’ customizations. In De Decker, B.
and Z
´
uquete, A., editors, Communications and Multi-
media Security: 15th IFIP TC 6/TC 11 International
Conference, CMS 2014, Aveiro, Portugal, Septem-
ber 25-26, 2014. Proceedings, pages 19–32. Springer
Berlin Heidelberg, Berlin, Heidelberg.
Statista (2017). Number of smartphone users
worldwide from 2014 to 2020 (in billions).
https://www.statista.com/statistics/330695/number-
of-smartphone-users-worldwide/ [Online; accessed
07-June-2017].
TechAdvisor (2016). How to get developer options on
android. http://www.pcadvisor.co.uk/how-to/google-
android/34-useful-things-you-can-do-in-android-
developer-options-new-3590299 [Online; accessed
07-June-2017].
Tischer, M., Durumeric, Z., Foster, S., Duan, S., Mori, A.,
Bursztein, E., and Bailey, M. (2016). Users really do
plug in usb drives they find. In 2016 IEEE Symposium
on Security and Privacy (SP), pages 306–319.
Wang, Z., Johnson, R., Murmuria, R., and Stavrou, A.
(2012). Exposing security risks for commercial mo-
bile devices. In Proceedings of the 6th International
Conference on Mathematical Methods, Models and
Architectures for Computer Network Security: Com-
puter Network Security, MMM-ACNS’12, pages 3–
21, Berlin, Heidelberg. Springer-Verlag.
Wang, Z. and Stavrou, A. (2010). Exploiting smart-phone
usb connectivity for fun and profit. In Proceedings of
the 26th Annual Computer Security Applications Con-
ference, ACSAC ’10, pages 357–366, New York, NY,
USA. ACM.
Xu, M. (2014). Security enhancement of secure USB de-
bugging in Android system. Master’s thesis, Univer-
sity of Toledo, USA. in http://utdr.utoledo.edu/theses-
dissertations.
Xu, M., Sun, W., and Alam, M. (2015). Security enhance-
ment of secure USB debugging in android system. In
2015 12th Annual IEEE Consumer Communications
and Networking Conference (CCNC), pages 134–139.
Exploring USB Connection Vulnerabilities on Android Devices - Breaches using the Android Debug Bridge
577