In a world increasingly reliant on technology, the last thing you’d expect when purchasing a TV streaming box is to unwittingly welcome a Trojan horse into your home. Unfortunately, this nightmare scenario has become a harsh reality for thousands of unsuspecting users who own affordable Android TV devices.
Back in January, a vigilant security researcher by the name of Daniel Milisic made a shocking discovery. A budget-friendly Android TV streaming box, known as the T95, was found to be harboring malicious malware right from the moment it left the factory. This revelation sent shockwaves through the cybersecurity community, with multiple experts subsequently verifying these findings. Yet, what emerged was far more sinister than anyone could have anticipated.
Recently, the cybersecurity firm Human Security has unearthed new, alarming revelations about the scale of this malicious intrusion and the intricate web of fraudulent schemes connected to these Android TV devices. The implications are profound, and the consequences are dire.
The Malicious Intrusion
Human Security researchers have uncovered a total of seven Android TV boxes and one tablet, all infected with unkillable backdoors. Perhaps even more unsettling, they’ve identified signs of over 200 different Android device models that could potentially be affected by this insidious malware. These compromised devices have found their way into households, businesses, and even educational institutions across the United States. To compound the issue, Human Security has exposed the existence of an advertising fraud network that is closely tied to these schemes—a network that likely facilitated the funding of these criminal operations.
Gavin Reid, the Chief Information Security Officer (CISO) at Human Security, leads the company’s Satori Threat Intelligence and Research team. In describing the severity of the situation, Reid states, “They’re like a Swiss Army knife of doing bad things on the Internet. This is a truly distributed way of doing fraud.” As a responsible entity in the fight against cybercrime, Human Security has taken the initiative to collaborate with law enforcement agencies, sharing crucial information about the facilities that may have been involved in manufacturing these compromised devices.
The Research Divide
Human Security’s research can be divided into two distinct areas of focus: Badbox and Peachpit.
Badbox: This segment pertains to the compromised Android devices themselves and their role in perpetrating fraudulent activities and cybercrimes. These devices, often available for less than $50, are frequently sold online and in physical stores, typically without branding or under different aliases to obscure their true origin. In the latter half of 2022, Human Security identified an Android app linked to inauthentic web traffic, connected to the domain flyermobi.com. This discovery was a critical breadcrumb, echoing Daniel Milisic’s initial findings regarding the T95 Android box in January. Human Security’s research team proceeded to purchase these compromised devices and delve deeper into their secrets.
In total, the researchers confirmed the existence of eight devices with preinstalled backdoors, including seven TV boxes (T95, T95Z, T95MAX, X88, Q9, X12PLUS, and MXQ Pro 5G) and a tablet (J5-W). Remarkably, other security researchers have also identified some of these compromised devices in recent months. Human Security’s report, led by data scientist Marion Habiby, has revealed at least 74,000 Android devices worldwide exhibiting signs of Badbox infection, including devices within educational institutions across the United States.
Peachpit: This facet of Human Security research deals with a related advertising fraud operation involving a minimum of 39 Android and iOS apps. Google has taken swift action, removing these apps following Human Security’s research. Likewise, Apple has identified issues in several of the reported apps.
The implications of this alarming discovery are far-reaching, and it underscores the critical importance of cybersecurity vigilance in an increasingly interconnected world. As consumers, it’s crucial to remain informed about potential threats, stay vigilant, and take necessary precautions to protect our digital lives. While the full extent of the damage caused by these unkillable backdoors is still unfolding, one thing is certain: the battle against cyber threats rages on, and our collective awareness and preparedness are our strongest weapons in this ongoing war.
Stay tuned for further updates on this evolving story, and remember—vigilance is our greatest defense in the digital age.
How do I scan my Android for viruses or malware?
Scanning your Android device for viruses or malware is essential to ensure its security. Here’s how you can do it:
- Use Antivirus Apps: Install a reputable antivirus app from the Google Play Store. Popular options include Avast, McAfee, Bitdefender, and Norton. Once installed, open the app, and follow the on-screen instructions to run a scan. The antivirus app will check your device for malware and other security threats.
- Google Play Protect: Android devices come with a built-in security feature called Google Play Protect. To enable it, go to your device’s settings, then navigate to “Security” or “Privacy,” and find the option for Google Play Protect. Ensure that it’s turned on. Google Play Protect continuously scans your apps for potential threats.
- Regularly Update Apps and the OS: Keeping your Android device and apps up to date is crucial. Developers release updates to patch security vulnerabilities. Go to your device’s settings, and under “Software Updates” or “System Updates,” check for and install any available updates.
- Avoid Third-Party App Stores: Stick to downloading apps from the official Google Play Store. While some third-party app stores are safe, they can be riskier in terms of malware. Make sure “Install from unknown sources” is disabled in your settings to prevent sideloading apps from unverified sources.
- Check App Permissions: Review the permissions requested by each app before installing it. Be cautious if an app asks for unnecessary permissions that don’t align with its functionality.
- Regular Backups: Back up your important data and files regularly. In case malware removal requires a factory reset, you’ll still have your data.
Can Android phones have malware?
Yes, Android phones can be infected with malware. While Android’s open nature allows for flexibility and customization, it can also make devices more susceptible to malware if users are not cautious. Malware can be introduced through malicious apps, infected files, phishing attacks, or even by visiting compromised websites. To protect your Android device, practice good cybersecurity habits and use antivirus software.
How do I remove hidden malware from my Android?
If you suspect your Android device has hidden malware, here are steps to remove it:
- Boot into Safe Mode: Restart your device in Safe Mode by pressing and holding the power button, then tapping and holding the “Restart” or “Power Off” option. This will disable third-party apps.
- Uninstall Suspicious Apps: Go to your device’s settings, then to “Apps” or “Application Manager.” Review the list of installed apps and uninstall any that you don’t recognize or trust.
- Clear Cache: In the same “Apps” or “Application Manager” settings, clear the cache and data of any suspicious apps.
- Scan with Antivirus: Run a full scan using your antivirus app. Allow it to identify and remove any malware it detects.
- Update Your OS and Apps: Ensure that your device’s operating system and all apps are up to date with the latest security patches.
- Change Passwords: If your device had sensitive data and you suspect it may have been compromised, change your passwords for important accounts.
- Factory Reset (Last Resort): If malware persists or the device’s performance is severely affected, consider performing a factory reset. This will erase all data on your device, so be sure to back up your important data first. To do a factory reset, go to your device’s settings, find the “System” section, and select “Reset” or “Factory Reset.”
What is Android malware?
Android malware refers to malicious software designed to infect Android devices with the intent of causing harm, stealing information, or engaging in fraudulent activities. This malware can take various forms, including viruses, Trojans, spyware, ransomware, adware, and more. It can be spread through infected apps, phishing emails, malicious websites, or compromised files. Android malware can compromise device security, privacy, and functionality, making it crucial for users to take proactive steps to protect their devices and personal data.
