Nobody Suspects the TV - From an Open ADB Port to Network Proxy via Chisel
In this blog, I’ll show how an unauthenticated Android Debug Bridge (ADB) port on a Smart TV gave me an instant root shell on the device, and how I turned that shell into a covert SOCKS proxy using chisel, routing my network traffic through a television set sitting in a room somewhere on the network. Prologue “The telescreen received and transmitted simultaneously.” - George Orwell, 1984 The smart TV in the corner of the room is always on, always connected, and always trusted. It sits on the network alongside everything else, pulling firmware updates, streaming content, phoning home to telemetry servers. Nobody monitors its traffic, nobody patches its firmware, and nobody thinks to ask what else it might be doing. Under the hood, it runs Android on a full Linux kernel, and if someone left its debug port open, you don’t need a vulnerability at all. You just need to connect. ...