A USB debugging query appears if it tries to connect to the smartphone. The first Android worm, called ADB.Miner, exploits the open ADB interface. To do this, the developer options must be deactivated in the settings of the Android smartphone, if activated. “However, some providers - for example those based in Asia in this case - have apparently neglected to switch off the enabled ADB interface before selling the devices to consumers.” This interface is normally disabled by default. “ADB is actually used by software developers to gain direct access to the device so they can carry out diagnoses or post-installations,” says Alexander Burris, Lead Mobile Researcher at G DATA. A wide range of device activities can be carried out via ADB - from simply reading the device information to the theft of sensitive data and security-critical installation of malware. Because TCP port 5555 has been opened via the Android Debug Bridge (ADB) interface, they can piggy-back onto the device. What looks like a complex and presumably impossible scenario becomes easy for cyber attackers via an Android vulnerability.

The individual steps that the worm performs on the smartphone are shown here.Īn unknown third-party user accesses the Internet on his own smartphone - but with full root rights as administrator.

Android worm virus