Android trojan RedHook learns to gain shell access via wireless ADB

Security researchers have spotted a new version of the RedHook Android malware that employs a previously unseen method of gaining elevated privileges on infected devices.

The malicious program abuses the Wireless ADB (Android Debug Bridge) feature — a wireless debugging mechanism built into the Android operating system. This capability is normally used by developers to debug apps through shell access to a device without physically connecting a cable to a computer.

According to the researchers, the new version of RedHook leverages Wireless ADB precisely to obtain command-level shell access without requiring a connection to a computer. This sets the new wave of attacks apart from the classic scenarios, in which ADB exploitation implied a physical or wired connection to the attacker's PC.

This approach lets the malware operate more stealthily and autonomously, reducing its reliance on additional infrastructure to control the infected device.

Details about RedHook's distribution mechanisms and the scale of the campaign are not disclosed in the report. Experts advise Android users to keep an eye on their wireless debugging settings and to turn the feature off when it isn't needed for everyday tasks, since an enabled Wireless ADB could become an entry point for attacks like these.

Source: Bleeping Computer