Android Debug Bridge

I have also been experimenting with Codex and Switchify recently.

I wrote a harness where Codex looks at a screenshot, reasons about what is on screen, and chooses which Switchify action to send over ADB as if it only had switches.

Some of the results gave me pause.

If the AI could not understand the UX from what was visible on screen, that made me think I should rethink parts of the UX because a real user might have the same uncertainty.

I have also been experimenting with AI as a testing tool.

One example is the Codex and Switchify harness I built.

It takes a screenshot, asks Codex to reason about what is on screen, and then sends a Switchify action over ADB as if the agent only had switches.

That has been useful because when the AI misunderstands the UX, it makes me ask whether the UX is actually clear enough.

Uh, guys, with mods like this, am I right? Ha ha.

Android RAT spreads over ADB.

Researchers at Dark Atlas documented a new Android remote access Trojan called THost 9 that conceals itself inside an app package before deploying a second stage payload to give attackers shell access and other malicious capabilities.

The unique feature here is that it scans for other Android devices with exposed Android debug bridge services enabled, then authenticates and installs itself on any device it can reach.

This appears linked to an earlier variant that spread with real world infections back in twenty twenty four.

The researchers recommend not exposing ADB to the internet, which is probably good advice even without this RAT in the wild.

All right, so this sounds like one of those, um...

This is a piece of malware that scans the Android device, so obviously this is targeting Android tablets, Android phones, Android, um, Fire Sticks and stuff like that.

An Android Trojan hides its payload in the app package, then scans for debug ports left open and installs itself on whatever answers.

Turn off ADB over TCP on your managed Android fleet.

Fifteen.

Where the UEFI shell ships inside Flash, an administrator who can change the boot order can start it and use its memory write commands to turn off the checks secure boot relies on.

The scary part of these things is that it's possible to install apps on these boxes, even if they're inside your home network.

Plume said that they focused on Superbox, but that other similar devices probably do very similar things because basically the box has an open ADB port that connects from the box to back home.

And that means people can access that channel, even if it's behind a firewall, because you open the firewall to allow it to download stuff, right? So now somebody can push things onto it, and that's what they were doing.

They're pushing things on there that allow them both to extract information from your network, as well as use this as a platform to attack other places.