842747 - Support secure adb

Status: RESOLVED WONTFIX

(Core Graveyard :: Widget: Gonk, defect)

Description

[Guillaume Destuynder [:kang] [this account is no longer active]]

http://android-developers.blogspot.com/2013/02/security-enhancements-in-jelly-bean.html

Newer adb uses a public key based authentication, which prompts the user to accept the fingerprint on the phone at the first connection of a new device. In a nutshell, that's relatively similar to what openssh does to authenticate a server.

This is useful security-wise or phones having adb constantly enabled (mostly, for eng builds and developers).
This is also only useful when the phone is protected by a locking mechanism (ie more than switch/push to unlock)

Since there is a user side prompt, it needs more than an adb upgrade.

This is implemented in ADB version 1.0.31 and above, and in Android devices running Android 4.2.2 and above.

Comment 2

[Florian Bender]

Any ETA on this?

Comment 3

[Paul Theriault [:pauljt] (no longer reading bugmail)]

(In reply to Florian Bender from comment #2)
> Any ETA on this?

As far as I know, no one is working on this currently. 

Is this still a priority though, now that we stop adb connections from being initiated while the device is locked (bug 810092)? I suppose its still useful for developers who don't want to have to unlock their device before every connection or disable the lockscreen entirely. Seems like a small subset though.

Comment 4

[Guillaume Destuynder [:kang] [this account is no longer active]]

note: this is also a nice explanation of what its doing http://nelenkov.blogspot.com/2013/02/secure-usb-debugging-in-android-422.html

Comment 5

[Frederik Braun [:freddy]]

Now that we're beyond 4.2.2 (jelly bean), we should take that into consideration again.

Comment 6

[Michal Purzynski [:michal`] (use NEEDINFO)]

Who is actively working on it?

Having it enabled would be a huge security gain for the foxfooding project. Right now a device with developer mode enabled is helpless like a baby :(

Comment 7

[Thomas Daede [:TD-Linux]]

>Is this still a priority though, now that we stop adb connections from being initiated while the device is locked

This doesn't happen for any of the foxfooding devices, which I have filed as a separate bug (#1185853)

Comment 8

[Michal Purzynski [:michal`] (use NEEDINFO)]

This bug should get a big priority bump, because right now I can just connect via ADB to a screen locked device and get root, with developer mode enabled.

Can we have at least an option for adb to reject connections when the screen is off?

Comment 9

[Dave Hylands [:dhylands]]

(In reply to Michal Purzynski [:michal`] (use NEEDINFO) from comment #8)
> This bug should get a big priority bump, because right now I can just
> connect via ADB to a screen locked device and get root, with developer mode
> enabled.
> 
> Can we have at least an option for adb to reject connections when the screen
> is off?

eng and userdebug builds leave adb enabled all of the time. user builds turn adb off when the screen is locked.

The reason we do this is that marionette uses userdebug builds and requires adb access to the phone to work properly.

Normally, we would be releasing user builds.

Having said all of that, it may make sense to add an additional option for adb which would have it turn off when the screen is locked, even for eng/userdebug builds. This would require UI changes. It would also be possible to implement it using a property, which would mean that you'd need to execute the setprop command from adb shell. This would not require any UI changes, and should be pretty easy to implement.

Bug 1035423 was created to do the inverse - force adb to be on all of the time. A simple change would allow us to force on/force off when locked/follow default behaviour.

Comment 10

[Thomas Daede [:TD-Linux]]

My first preference would be to fix this bug, as it allows both easy troubleshooting *and* using a userdebug build. But for me, the fastest-to-implement solution would be preferable. This is especially problematic because 

1) foxfooders are required to use the phone as their primary phone (or not participate in the program)
2) they are highly encouraged to irreversably switch to a userdebug build
3) this makes using basic features on the phone, e.g. email on the phone rather high risk

>it may make sense to add an additional option for adb which would have it turn off when the screen is locked, even for eng/userdebug builds.
To be clear, the option is already in the UI, but doesn't work, which is what bug 1185853 is about.

Comment 11

[Sylvestre Ledru [:Sylvestre]]

Closing as we are not working on Firefox OS anymore.