Kaspersky researchers have identified a new Android malware strain that infects car head units through their built-in software update mechanisms, turning these devices into tools for ad fraud and nodes in a proxy botnet. This marks the first documented instance of malware specifically targeting car head units with an infection chain tailored to such devices.
The malware is distributed via TWCore, a legitimate system application within the head units responsible for collecting analytics and pushing software updates. TWCore receives instructions from a message broker hosted at cardoor[.]cn, which dictates which application files to download and install. A notable feature in these instructions is an "installNotExists" Boolean flag, which, when set to true, allows TWCore to install applications not originally present on the device.
The affected head units utilize firmware from DoFun, a Chinese company specializing in infotainment software for aftermarket car systems. Kaspersky has attributed the operation with high confidence to the MoYu Group, an actor previously linked to the BADBOX botnet, a global network of consumer products sold with pre-installed firmware backdoors, first identified by HUMAN Security in 2023.
The infection process unfolds in three stages. The initial stage involves a small, minimalist dropper named JarService, whose sole function is to unpack and transfer control to the subsequent stage. The second stage is a loader that transmits basic device information to a remote server and then retrieves a download link for the final payload. Researchers observed seven distinct variants of this payload, indicating ongoing development and updates to the operation.
The third stage of the malware checks in with a remote server every 90 minutes, sending details such as the device's screen resolution, model, connected Wi-Fi network name, and MAC address, while awaiting commands. Kaspersky identified nine built-in commands: `return`, `copy`, `http`, `web`, `loadlib`, `loadlib2`, `loadlib3`, `deeplink`, and `traceroute`. Of these, only `loadlib2` and `http` were observed in active use, with `loadlib2` downloading the `zhima` reverse proxy module.
Independently, Nokia's Deepfield team also discovered the `zhima` module around the same time, but on TV set-top boxes rather than car head units. This parallel discovery reinforces the conclusion that the attackers' primary objective is to construct a proxy botnet.
Car head units, often equipped with SIM card slots and internet connectivity for features like navigation and software updates, typically do not store high-value data for attackers. Consequently, their recruitment into a botnet, akin to attacks on IoT devices, is a probable attack scenario using conventional Android malware.
Following responsible disclosure by Kaspersky, DoFun has confirmed that it has addressed the vulnerability. This incident highlights a sophisticated delivery method leveraging legitimate system update functionality and underscores the expanding threat landscape to include new platforms like car head units, necessitating enhanced malware protection for these devices.
