A newly discovered Android malware, distributed through the built-in updaters in affected Android-based car head units, turns infected devices into ad-fraud tools and nodes in a proxy botnet, Kaspersky has found.
According to the researchers, it’s the first documented case of malware found on a car head unit with an infection chain specific to that type of device.
“It’s worth noting that head units often include SIM card slots and can connect to the internet, enabling features like navigation and software updates. Since a head unit typically holds nothing of value to an attacker, one of the more likely attack scenarios using ‘classic’ Android malware is infecting the device to recruit it into a botnet – similar to attacks on IoT devices,” researchers explained.
Kaspersky attributes the operation, with high confidence, to the MoYu Group, an actor linked to the BADBOX botnet.
BADBOX is a global network of consumer products sold through the ordinary hardware supply chain, with a firmware backdoor already installed. HUMAN Security’s researchers first identified it in 2023.
The affected devices run firmware from DoFun, a Chinese company that supplies infotainment software for aftermarket car head units.
The entry point was TWCore, a legitimate system app whose job is to collect analytics and push software updates to the head unit. TWCore takes its instructions from a message broker hosted on a domain called cardoor[.]cn, which tells it which app files to download and install.
“Notably, the object describing this message includes an installNotExists field, a Boolean flag that can be set to true or false. This flag allows TWCore to install apps that weren’t originally present on the device,” they noted.
Three stages, one botnet
The infection runs in layers. Stage one is a small, bare dropper called JarService. It has no other purpose than to unpack and hand off to the next stage.
Head unit infection scheme (Source: Kaspersky)
Stage two is a loader. It sends basic information about the infected device to a remote server, then receives a download link for the next payload. That link includes a version number, and the researchers tried other numbers to see what would come back. They found seven distinct variants of the payload, which suggests the operation has been running and updating over some time.
Stage three checks in with a remote server every 90 minutes, sending along the device’s screen resolution, model, connected Wi-Fi network name and MAC address, then waits for commands from the attackers’ server.
Kaspersky counted nine different commands built into the malware:
- return — pulls a stored value back from the device
- copy — sets the contents of the clipboard, optionally pulling in extra data from a link
- http — sends a request to a server and can save the response
- web — opens a link in a hidden browser view and runs JavaScript inside it
- loadlib — not finished at the time of the report
- loadlib2 — downloads and runs more code
- loadlib3 — not finished at the time of the report
- deeplink — opens a link in the phone’s browser
- traceroute — checks whether a target address is reachable
Only loadlib2 and http were seen in use, with loadlib2 pulling down zhima, the reverse proxy module. Researchers at Nokia’s Deepfield team found the same module independently, around the same time, on TV set-top boxes rather than cars.
“This confirms that the attackers’ ultimate goal is building a proxy botnet.”
After Kaspersky disclosed the flaw responsibly, DoFun says it has closed the gap.
“The case examined here demonstrates an even more sophisticated delivery method: distribution through the legitimate update functionality of a system application. Attackers are also actively expanding into new platforms. This malware is the first known malicious app targeting head units, which means these platforms now require protection against malware as well,“ Kaspersky concluded.
