USB Debugging Activation in Mobile Application Security- Significant or not ?

Part 3- Secure Android App Development

ICIC Bank Android App

This article delves into the importance of verifying USB debugging activation as part of mobile application security protocols. While some debate the necessity of this measure, citing perceived low risks, it remains a consideration, particularly in applications requiring stringent security measures. We will discuss this mainly because-

1. The OWASP Mobile Application Security Testing Guide (MASTG) recommends checking for USB Debugging activation as part of its Device-Access-Security Policy
2. A lot of banking and finance applications verify USB debugging activation

Understanding USB Debugging Activation

USB debugging enables advanced functionality on Android devices, facilitating tasks such as app debugging and data transfer between devices and computers. However, its activation poses security concerns, as it grants elevated privileges that could be exploited by malicious actors. While Android’s security mechanisms, such as RSA key authentication for debugging, offer some protection, the perceived risk persists, particularly in scenarios involving physical access to devices.

The debate

This reddit discussion argues against this check vehemently. Here the redditers argue that the risks associated with unauthorized USB debugging are overstated, citing Android’s built-in security feature (latest Android devices anyway)

What we know this can achieve ?

We will prevent applications like Scrcpy or Vysor from mirroring the application screen on computer since that will require USB debugging enabled to be true and if we have a check for the same we can prevent our app from going any further than the Splash screen (Please don’t start on the splash screen debate 😛 )

There have been mentions of Juice Jacking using USB connection on public charging ports. (This easily could be a media hype)

All said and done, this is listed in the OWASP MASTG and if your app warrants being paranoid about security- follow the recommended best practices for which here is the simple check to verify if USB Debugging is enabled or not.

/**
 * return true if debugging enabled else return false
 * requires context to fetch the Settings
 */
fun isUsbDebuggingEnabled(context: Context): Boolean {
    return (Settings.Secure.getInt(
        context.contentResolver,
        Settings.Global.DEVELOPMENT_SETTINGS_ENABLED,
        0
    ) == 1)
}

If it is very critical to stop any background tasks or workers to execute in the background we can register a Broadcast for USB connected state and then query the Settings using the above function to check the USB Debugging enabled

 val filter = IntentFilter()
 filter.addAction("android.hardware.usb.action.USB_STATE")

Code is on Github- https://github.com/ChaitanyaDuse/SecureAndroidApp/tree/usb-debugging-check

Resources -

OWASP MASTG - OWASP Mobile Application Security

Testing the Device-Access-Security Policy

Juice jacking: Is it a real issue or media hype?

Android Debug Bridge (adb) | Android Studio | Android Developers