CyberCertPrepMobile Security FundamentalsMobile OS ArchitectureEASYFree question
What is Android's 'userdebug' build variant and why is it considered insecure for production deployments?
- A.userdebug enables root access via 'adb root', includes debugging symbols, and may run with SELinux in permissive mode - it is intended only for testing
- B.userdebug disables the Keystore and replaces it with a software-only implementation for debugging convenience
- C.userdebug uses a shared signing key that is publicly known, allowing anyone to install updates
- D.userdebug removes Play Protect and allows system apps to be sideloaded without verification
Why A is correct
Android build variants: 'user' is the locked-down production build; 'userdebug' is similar to user but with root access enabled via ADB, additional debug capabilities, and sometimes SELinux in permissive mode; 'eng' is the full engineering build. Production devices ship with 'user' builds. A userdebug build on a production deployment allows any computer with USB access to gain root - completely bypassing the DAC and MAC security model.
Know someone studying for Mobile Security Fundamentals? Send them this one.