Article Details
Scrape Timestamp (UTC): 2024-09-12 21:15:11.946
Original Article Text
Click to Toggle View
New Vo1d malware infects 1.3 million Android TV streaming boxes. Threat actors have infected over 1.3 million Android TV streaming boxes with a new Vo1d backdoor malware, allowing the attackers to take full control of the devices. Android TV is Google's operating system for smart TVs and streaming devices, offering an optimized user interface for TVs and remote navigation, integrated Google Assistant, built-in Chromecast, live TV support, and the ability to install apps. The operating system powers the smart TV features for numerous manufacturers, including TCL, Hisense, and Vizio TVs. It also acts as the operating system for standalone TV streaming media devices, such as the NVIDIA Shield. In a new report by Dr.Web, researchers found 1.3 million devices infected with the Vo1d malware in over 200 countries, with the largest number detected in Brazil, Morocco, Pakistan, Saudi Arabia, Russia, Argentina, Ecuador, Tunisia, Malaysia, Algeria, and Indonesia. The Android TV firmware seen being targeted in this malware campaign include: Depending on the version of the Vo1d malware installed, the campaign will modify the install-recovery.sh, daemonsu, or replace the debuggerd operating system files, all of which are startup scripts commonly found in Android TV. The malware campaign uses these scripts for persistence and to launch the Vo1d malware on boot. The Vo1d malware itself is located in the files wd and vo1d, which the malware is named after. "Android. Vo1d's main functionality is concealed in its vo1d (Android.Vo1d.1) and wd (Android.Vo1d.3) components, which operate in tandem," explains Dr.Web. "The Android.Vo1d.1 module is responsible for Android. Vo1d.3's launch and controls its activity, restarting its process if necessary. In addition, it can download and run executables when commanded to do so by the C&C server." "In turn, the Android.Vo1d.3 module installs and launches the Android.Vo1d.5 daemon that is encrypted and stored in its body. This module can also download and run executables. Moreover, it monitors specified directories and installs the APK files that it finds in them." While Dr.Web does not know how Android TV streaming devices are being compromised, researchers believe they are targeted because they commonly run outdated software with vulnerabilities. "One possible infection vector could be an attack by an intermediate malware that exploits operating system vulnerabilities to gain root privileges," concludes Dr.Web. "Another possible vector could be the use of unofficial firmware versions with built-in root access." To prevent infection by this malware, it is advised that Android TV users check for and install new firmware updates as they become available. Also be sure to remove these boxes from the internet in case they are being remotely exploited through exposed services. Last but not least, avoid installing Android applications as APKs from third-party sites on Android TV as they are a common source of malware. A list of IOCs for the Vo1d malware campaign can be found on Dr. Web's GitHub page.
Daily Brief Summary
Over 1.3 million Android TV streaming boxes globally have been infected with the Vo1d backdoor malware.
Brazil, Morocco, Pakistan, and several other countries report the highest number of infections.
The Vo1d malware modifies key system scripts for persistence and launches malicious processes on the device startup.
Infected devices may exhibit unauthorized downloading and execution of executables under the command of a central control server.
The malware affects various versions of the Android TV firmware, exploiting their vulnerabilities.
Potential infection vectors include attacks exploiting system vulnerabilities or installations from unofficial firmware versions.
Dr. Web advises frequent firmware updates, limiting APK downloads from third-party sites, and disconnecting infected devices from the internet to mitigate risks.
A list of Indicators of Compromise (IOCs) related to the Vo1d malware campaign is available on Dr. Web's GitHub page for further reference and action.