Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware developed by DoFun. The end goal of the malware is to serve a multi-stage downloader to enable ad fraud and creation of a proxy botnet.
Intelligence analysis by Llama
A new malware family has been discovered that targets Android-based vehicle head units. The malware is designed to enable ad fraud and creation of a proxy botnet. It spreads through the built-in updaters of Android-based automotive head unit firmware.
Imagine your car's computer system getting hacked. This malware is like a virus that infects the computer system of your car's head unit, allowing hackers to display ads and steal information about your car. It's like a cyber attack on your car's computer.
Analysis
MoYu Group Attribution
The activity has been attributed with high confidence to the MoYu Group, which was outed by the HUMAN Satori Threat Intelligence and Research team last year as part of a broader ad fraud and residential proxy scheme dubbed BADBOX.
Malware Delivery Methods
The delivery methods for such malware are becoming highly varied – ranging from pre-installed backdoors to compromised IPTV applications. In this researched case, we observed an even more sophisticated delivery method exploiting the legitimate software update functionality of a system app.
Malware Functionality
The malware supports nine commands capable of displaying unwanted advertisements, executing ad fraud, and downloading additional malicious modules. It also allows attackers to receive extensive device information, including display resolution, device model, connected Wi-Fi network identifier, and MAC address.
Reverse Proxy Module
The threat actors have been found to leverage 'loadlib2' and 'http' commands to download 'zhima,' a reverse proxy module documented by Nokia Deepfield Emergency Response Team last month and selectively delivered via IPTV apps installed in cheap Android TV boxes.
Implications
This malware has become the very first malicious application specifically targeting car head units through an infection chain explicitly tailored for these vehicle systems. This serves as a warning that modern automotive platforms urgently require robust protection against malware.
Key points
- A new malware family has been discovered that targets Android-based vehicle head units.
- The malware is designed to enable ad fraud and creation of a proxy botnet.
- The malware spreads through the built-in updaters of Android-based automotive head unit firmware.
- The malware has been attributed to the MoYu Group with high confidence.
- The malware supports nine commands capable of displaying unwanted advertisements, executing ad fraud, and downloading additional malicious modules.
If this development plays out positively, car manufacturers may take steps to improve the security of their head units, making it harder for hackers to infect them. This could lead to a safer and more secure driving experience for car owners.
The realistic downside risks or failure modes of this malware include the potential for widespread infection of car head units, leading to a significant loss of data and potentially even physical harm to drivers. Additionally, the malware's ability to display unwanted advertisements could lead to a decrease in driver engagement and safety.
