Void captures over a million Android TV boxes
Doctor Web reported that the Android.Vo1d malware has infected 1.3 million Android TV boxes worldwide, modifying system files for persistence, primarily affecting users in Brazil, Morocco, and Pakistan.
Read original article
Doctor Web has reported the discovery of a malware strain named Android.Vo1d, which has infected approximately 1.3 million Android TV boxes across 197 countries. This backdoor malware allows attackers to secretly download and install third-party software on compromised devices. The infection was first noted in August 2024 when users reported unusual changes in their system files. The malware modifies critical system files, including install-recovery.sh and daemonsu, to ensure its persistence and auto-launch capabilities upon device reboot. The trojan disguises itself by using similar names to legitimate system files, complicating detection. The most affected regions include Brazil, Morocco, and Pakistan, with many devices running outdated Android versions that are no longer supported with security updates. The source of the infection remains unclear, but it may involve exploiting vulnerabilities in the operating system or using unofficial firmware. Dr.Web antivirus software can detect and remove all known variants of the Android.Vo1d trojan, provided the device has root access.
- Android.Vo1d has infected around 1.3 million Android TV boxes globally.
- The malware modifies system files to maintain persistence and auto-launch on reboot.
- The largest number of infections were reported in Brazil, Morocco, and Pakistan.
- Many infected devices run outdated Android versions, making them vulnerable.
- Dr.Web antivirus can detect and cure infected devices if root access is available.
Related
Telegram zero-day allowed sending malicious Android APKs as videos
A zero-day vulnerability in Telegram for Android, named 'EvilVideo,' allowed attackers to send malicious APK payloads disguised as videos. The flaw was patched in version 10.14.5 after responsible disclosure. Users should update their app.
Telegram zero-day for Android allowed malicious files to masquerade as videos
Researchers found a zero-day exploit in Telegram for Android, named EvilVideo. Telegram fixed it in versions 10.14.5+. Attackers could send malicious files as videos. Exploit sold on forum. Patched version prevents automatic downloads. Threat actor unknown.
Mysterious family of malware hid in Google Play for years
A family of Android malware named Mandrake has been found in Google Play, evading detection for years. It steals credentials and executes malicious applications, highlighting challenges in malware detection.
Pixel smartphones delivered with secret but inactive remote maintenance
Millions of Pixel smartphones have an inactive remote maintenance software, posing potential security risks. A patch is being developed for removal, emphasizing the need for transparency in third-party applications.
Found: Android apps that use OCR to steal cryptocurrency credentials
Researchers found over 280 malicious Android apps using OCR technology to steal cryptocurrency wallet credentials. These apps disguise as legitimate services and are spreading from South Korea to the UK.
- Many users express frustration over outdated Android versions on TV boxes, which lack security updates and are often produced by unreliable manufacturers.
- There is skepticism about the security of generic TV boxes, with some suggesting they may come pre-installed with malware.
- Concerns are raised about the effectiveness of auto-updates for security, with some advocating for more secure design principles instead.
- Users question the network security of these devices, wondering how they can be compromised despite being behind firewalls.
- Some comments clarify the terminology, emphasizing that these are TV boxes running Android rather than dedicated Android TV devices.
13 commentsAh the new economical divide.
Most "real people" also have phones which aren't receiving updates for a few years by now.
In south america the median android version is 8.
And phones are not optional as most countries already jumped into both digital government and money transfer.
Many of them NEVER received a single update ever. There are so many shady companies producing TV boxes with no plan to ever provide any updates.
Unless one of the larger brands make such a device, I don't see any reason to recommend anything but the ChromeCast or whatever Google calls it now. Or a Roku or an AppleTV, if you swing that way.
Quite a few of them actually end up configured to preference SD boot over internal flash and/or have easily accessible buttons or shortable pads to trigger bootrom recovery modes.
Which at least, stops them being automatically consigned to e-waste.
Although, customising a LibreELEC image for the dozens of different models of TV box isn't great. Typically involves sorting out the dts for the device and remapping the remote.
While Go and Rust aren't necessarily magic pixie-dust that can account for all types of security vulnerabilities, if I'm going to be faced with the possibility of some project being abandoned at some point for the next new shiny thing that everyone would rather work on, I'd at least like to give it a fighting chance of remaining secure for some time after abandonment without any updates. Ideally it would be a Rust userspace media management package running on Debian Stable getting unattended upgrades every night.
Since nothing like that exists I've recently decided to give CoreELEC/Kodi a try on an ODROID-N2+, albeit disconnected from any network. I was surprised at how seamless and integrated everything was.
The remote control for my television "just worked" with it out of the box thanks to HDMI CEC support. Arrow buttons, play/pause, back, etc. all did just what I expected them to do. It's a marked improvement from the last time I built a custom media box, which I had running MythTV on Gentoo, when I needed to jump through hoops to set up an IR blaster. And you can't argue with a 12v/2a power supply.
For now I'm keeping it off my home network and am "sneaker-netting" content on a USB drive between my trusted devices and the ODROID. When I get tired of doing that I might add some firewall rules to my router to only allow it to talk to a locked-down VM doing nothing but hosting a read-only file share. But some day I hope to look forward to building a similar form-factor box that has all the media gadgets and gizmos with a Rust userspace that respects my privacy and auto-updated Debian Stable so I can actually connect it to the Internet.
Auto updates also have a reputation for harming the user at least as often as helping (removing features, adding ads, whatever) and so trust in that is declining while the need for decent security (smart cars/homes) is increasing. Not sure what to conclude from this except that we need more focus on secure-by-design systems and maybe immutability guarantees rather than autoupdates, app stores, and plugin/extension frameworks but these things are sometimes impractical fundamentally and sometimes just inconvenient for surveillance capitalism.
This was apparently found due to seeing some changed files, so they didn’t ship with void, but it wouldn’t have been hard to push it out to pre-comprised boxes.
Related
Telegram zero-day allowed sending malicious Android APKs as videos
A zero-day vulnerability in Telegram for Android, named 'EvilVideo,' allowed attackers to send malicious APK payloads disguised as videos. The flaw was patched in version 10.14.5 after responsible disclosure. Users should update their app.
Telegram zero-day for Android allowed malicious files to masquerade as videos
Researchers found a zero-day exploit in Telegram for Android, named EvilVideo. Telegram fixed it in versions 10.14.5+. Attackers could send malicious files as videos. Exploit sold on forum. Patched version prevents automatic downloads. Threat actor unknown.
Mysterious family of malware hid in Google Play for years
A family of Android malware named Mandrake has been found in Google Play, evading detection for years. It steals credentials and executes malicious applications, highlighting challenges in malware detection.
Pixel smartphones delivered with secret but inactive remote maintenance
Millions of Pixel smartphones have an inactive remote maintenance software, posing potential security risks. A patch is being developed for removal, emphasizing the need for transparency in third-party applications.
Found: Android apps that use OCR to steal cryptocurrency credentials
Researchers found over 280 malicious Android apps using OCR technology to steal cryptocurrency wallet credentials. These apps disguise as legitimate services and are spreading from South Korea to the UK.